qa-testing-android
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documents the installation of the Maestro testing framework using a
curl | bashcommand targetingmaestro.mobile.dev. Maestro is a recognized service for mobile UI automation. - [PRIVILEGE_ESCALATION]: CI optimization and device management guides include commands that use
sudoto configure KVM permissions and reloadudevrules. This is a standard and necessary requirement for enabling hardware acceleration for Android emulators on Linux-based CI runners. - [COMMAND_EXECUTION]: The skill documentation describes the use of various CLI tools, including
adb,gradlew,emulator, andmaestro, to manage device state and execute test suites. - [EXTERNAL_DOWNLOADS]: Fetches testing tools, Gradle plugins, and documentation from various sources including official Android documentation, GitHub repositories for community-maintained tools (e.g., mannodermaus, cashapp, takahirom), and Maestro's infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection as it involves processing untrusted data from the application under test.
- Ingestion points: UI accessibility tree inspection and logcat capture (SKILL.md, uiautomator.md).
- Boundary markers: None identified.
- Capability inventory: Execution of adb, gradlew, and maestro commands (SKILL.md, uiautomator.md).
- Sanitization: None identified.
Audit Metadata