The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The AppLauncher utility now includes logic to direct users to an app store URL if a requested native application is not installed on the device. This is a standard and safe practice for app discovery and installation.
[COMMAND_EXECUTION]: The Android implementation uses MethodChannel to invoke isAppInstalled on the host side, which queries the PackageManager. This is a legitimate use of platform-specific APIs to check for the presence of other applications and does not involve arbitrary command execution.
[PROMPT_INJECTION]: The logic for determining if an action is a 'web executable' is strictly defined based on the URL scheme (http/https) and the presence of necessary metadata (packageName, appStoreURL), preventing manipulation of the execution flow via malformed NativeAppActionInfo objects.
[CREDENTIALS_UNSAFE]: No sensitive credentials or API keys are hardcoded in the proposed changes. The InAppReview API and url_launcher packages are used according to their respective security guidelines.

theme-create