android-bluetooth-sockets
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user or agent to execute a provided Python script (
scripts/inspect-project.py) to scan an Android project for potential Bluetooth-related security and implementation issues. - [INDIRECT_PROMPT_INJECTION]: The inspection script processes untrusted data by reading and parsing content from local project files, creating an attack surface where maliciously crafted source code or manifests could attempt to influence the agent's analysis results.
- Ingestion points: The script reads
.kt,.java,.gradle,.kts, andAndroidManifest.xmlfiles from the local filesystem. - Boundary markers: The script does not utilize specific boundary markers or delimiters to isolate untrusted data in its generated report.
- Capability inventory: The script is limited to local file system reading and gathering basic host information (operating system and architecture), outputting its findings to standard output.
- Sanitization: The script performs regex-based pattern matching but does not sanitize or escape the contents of identified code snippets before reporting them to the agent.
Audit Metadata