android-emulator-build
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of Android SDK tools such as
adb,emulator,avdmanager, andsdkmanager. It includes a dedicated safety module (android-device-safety.mjs) that proactively audits project scripts to ensure commands are constrained to specific emulator instances and do not use global or destructive flags that could impact other sessions on a shared machine. - [DYNAMIC_EXECUTION]: The skill's build pipeline utilizes
npx expo prebuildand Gradle, both of which execute dynamic logic defined in the project's configuration files. Additionally, internal utility scripts (check-lib.mjs) perform dynamic loading of local dependencies likepngjsfrom computed paths. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external artifacts such as Android manifests, Hermes bundles, and application configurations extracted from APKs. While the analysis is conducted via deterministic script logic, the results are presented to the AI agent for interpretation. This creates a surface where adversarial text embedded in an artifact (e.g., a maliciously named permission or configuration key) could attempt to influence the agent's behavior.
Audit Metadata