The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): The script scripts/build_and_test.py automatically searches for and executes gradlew in the current or parent directories. This pattern allows for arbitrary code execution if the agent is operating within an untrusted project directory containing a malicious Gradle wrapper.
[DATA_EXPOSURE] (MEDIUM): scripts/log_monitor.py and scripts/screen_mapper.py extract system logs and UI hierarchies. These sources frequently contain sensitive information, including PII, authentication tokens, and private user data, which are then ingested into the agent's context.
[INDIRECT_PROMPT_INJECTION] (LOW):
Ingestion points: scripts/screen_mapper.py (UI XML dump) and scripts/log_monitor.py (ADB logs).
Boundary markers: Absent. UI text and log messages are processed without delimiters or warnings to the agent to ignore embedded instructions.
Capability inventory: Significant. The skill allows app installation/uninstallation, text entry, and shell command execution via ADB.
Sanitization: Absent. Text from external apps is used directly for navigation and logic, allowing an attacker-controlled app to potentially influence agent behavior via on-screen text.
[COMMAND_EXECUTION] (LOW): Many scripts use subprocess to call adb. While inputs like package names and coordinates are generally handled via argument lists, scripts/log_monitor.py attempts to manually construct a command string for grep which, if modified to use shell=True in the future, would be highly vulnerable to injection.

android-emulator-skill