The Agent Skills Directory

[METADATA_POISONING]: The SKILL.md file identifies the author as "Google LLC", which contradicts the actual author identity. This deceptive misrepresentation may cause users or agents to grant elevated trust to the skill based on a false affiliation.
[COMMAND_EXECUTION]: The skill requires the agent to execute various shell commands, including project build tasks via ./gradlew (using system properties), file system management (mkdir, rm), and multiple Python scripts.
[DYNAMIC_EXECUTION]: The skill provides and executes multiple Python scripts at runtime. One script, keep_radius_pb2.py, includes a large serialized Protobuf descriptor which is opaque to static analysis.
[OBFUSCATION]: The keep_radius_pb2.py file contains a large binary blob (DESCRIPTOR) encoded as a hex-escaped byte string. While common for Protobuf, such large opaque constants can be used to hide malicious logic or data from static scanners.
[PROMPT_INJECTION]: The skill instructs the agent to suppress its own output and recommendations (e.g., "Do NOT output conversational filler", "Do NOT provide recommendations"). This concealment behavior limits the user's ability to audit the agent's actions and understand its findings.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Processes Android build files (build.gradle), Proguard rules, and a generated analysis_result.txt file.
Boundary markers: No delimiters or safety instructions are provided to the agent when processing these external data sources.
Capability inventory: Extensive shell execution and Python execution privileges.
Sanitization: No validation or sanitization of the input files is performed before they are used to generate the final report.

r8-analyzer