android-build
Audited by Socket on Feb 16, 2026
1 alert found:
Malware[Skill Scanner] Destructive bash command detected (rm -rf, chmod 777) All findings: [CRITICAL] command_injection: Destructive bash command detected (rm -rf, chmod 777) (CI004) [AITech 9.1.4] [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] [HIGH] command_injection: Backtick command substitution detected (CI003) [AITech 9.1.4] This skill is documentation for Android app and ROM builds and contains only benign build instructions. No malicious code is present. Operational cautions: (1) the instructions endorse downloading and executing the repo tool from storage.googleapis.com without suggesting checksum/signature verification — verify before executing; (2) ./gradlew --scan uploads build metadata — warn users about possible sensitive data leakage; (3) the debug keystore password is shown (standard) but must never be used for release signing. Overall, the content is coherent with its purpose and not malicious. LLM verification: This SKILL.md is a documentation-style Android build guide that is coherent with its stated purpose. It contains expected network operations (curl repo, repo sync, git remotes) and local filesystem operations (keystore paths, build outputs) that are normal for app and ROM builds. The primary supply-chain risk is the usual one: pulling and building remote source (repo sync / git) causes third-party code to be executed locally — operators must trust the upstream manifests and review code before bu