Security audit

Andorid Flyverify Integration

Security checks for vulnerabilities and agentic risk

Overview

The skill is aimed at Android FlyVerify setup, but it asks the agent to handle app secrets, edit build scripts, and run Gradle with unverified dynamic dependencies in ways users should review carefully.

Install only if you are comfortable with an agent modifying your Android project. Before running the Gradle step, pin the FlySDK version, verify the Maven source, inspect the full diff, and avoid putting real appSecret values in tracked files; use an ignored local secret file or environment/CI secret store instead.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:163
Finding: Unpinned Gradle Plugin Retrieved and Executed from a Third-Party Repository
Content: View full analysis
Remediation: View remediation
' ``` 2. Confirm and document that the repository is the SDK vendor's authoritative distribution endpoint. 3. Enable Gradle dependency verification and commit trusted checksums or signatures in `gradle/verification-metadata.xml`. 4. Use Gradle dependency locking so subsequent builds resolve the same reviewed artifacts. 5. Do not automatically execute Gradle immediately after changing dependency configuration. First display the exact repository, artifact, and resolved version and obtain explicit confirmation. 6. Avoid `--refresh-dependencies` during routine integration unless a refresh is necessary and the resulting artifacts will be independently verified. 7. In CI, execute Gradle in an isolated, least-privileged environment without unnecessary signing keys, deployment credentials, or access to unrelated repositories. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:124
Finding: Application Secret Is Embedded in a Tracked Build Script Without Safe Escaping
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a user-facing interactive integration assistant for Android FlyVerify onboarding. However, the supplied code is a standalone Python script that creates a formatted Excel template with setup fields and instructional text. While the content is related to FlyVerify and includes privacy/compliance guidance, the actual behavior is materially different from the declared purpose: it does not provide an interactive 5-step workflow, does not respond to user triggers, and does not implement Android integration assistance. The code’s primary purpose is document/template generation, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description frames the skill as an 'interactive guide' with confirmation at each step, which suggests advisory behavior. However, the documented workflow includes generating and copying files, reading secrets from Excel, modifying Gradle and source files, running Gradle commands, and creating a project README, making it an active project-modification skill rather than just a guide.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match ordinary Android login or integration support requests, which can cause the skill to activate in contexts where the user did not intend project-modifying guidance. In a system that can read files, generate configuration artifacts, or suggest code edits, overbroad invocation increases the chance of unintended handling of sensitive project data or inappropriate automated changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The applicable-scenario list contains ambiguous phrases such as requests to add one-click login or auto-configure FlyVerify, without enough scope boundaries around repository modification or credential handling. In this skill's context, those broad phrases are more dangerous because the workflow proceeds into reading project paths, creating files, and inserting code, which could be triggered unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow tells users to place appSecret into an Excel file in the project root and later read it back, but it provides no guidance on secret storage, access control, cleanup, or exclusion from version control. This is dangerous because app secrets can be accidentally committed, shared, indexed by tooling, or exposed to other local users and processes, leading to credential compromise and misuse of the MobTech account or service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings entirely in Chinese, including the instruction telling the user to reply with a specific Chinese phrase ("填好了"). Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale constraint is explicitly documented, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Both the manifest and the markdown repeatedly describe a '5-step workflow,' but the body defines steps 1 through 6, including a final completion step that generates a README. This is an active contradiction in the skill's own documentation about its intended process.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file presents all example invocations and usage questions exclusively in Chinese, with no indication that other languages are supported or that Chinese is optional. This can violate language/locale policy requirements when a skill implicitly constrains users to a specific language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.