android-project-generator

• Outcome: Pass
• Latest audit: Oct 3, 2026 · 5:36 AM UTC
• Version: 1.3.1

Overview

The skill openly supports Android project generation with local build checks and optional device install/launch verification, with no evidence of hidden credential access, persistence, or exfiltration.

Install only if you are comfortable with local Android build commands. Before enabling runnable verification, disconnect real devices you do not want modified or explicitly target the intended emulator/device, because adb install -r can replace an app and adb shell am start will launch it. Treat the included tests/ directory as development material, not required runtime behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code chunk does not generate Android projects, configure Gradle, set up JNI/NDK/CMake, or validate Android assembleDebug readiness. Instead, it supports Python-based testing by configuring pytest and supplying sample fixture data related to JDK/Android settings. While some fixtures reference Android/JDK concepts, they are only test samples, not implementation of the declared Android project creation/configuration behavior. This is a materially different primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about Android project scaffolding and build configuration, especially Gradle/JNI/NDK/CMake setup and compile-readiness validation. The actual code does none of that. It is entirely focused on Python test execution and reporting: checking for pytest installation, invoking pytest, stripping coverage args when needed, parsing textual test results, saving a JSON summary, generating an HTML report, and opening that report in a browser. This is a materially different primary purpose and includes undeclared capabilities unrelated to Android project generation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose centers on Android project creation and build configuration. However, the supplied code does not generate Android apps, configure Gradle, manage Android version compatibility, add native modules, or validate Android build readiness directly. Its primary function is to read test-report JSON data and render a localized HTML dashboard for test outcomes. This is a materially different purpose, so the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill creates and configures Android projects, including Gradle/JNI/NDK/CMake setup and build-readiness validation. The supplied code does none of that. It is a standalone Python test runner for executing unit/integration tests and generating reports. Its primary purpose is materially different from Android project generation or configuration, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is Android project generation and build configuration, but the supplied code does not interact with Android projects, Gradle, JNI/NDK, CMake, or build validation. Instead, it customizes the Python runtime environment for scripts executed from the tests directory by creating local cache/temp folders and redirecting pycache and tempfile behavior. This is a materially different primary purpose and introduces undeclared filesystem/runtime configuration behavior unrelated to the stated Android functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description centers on creating/configuring Android projects so they build successfully, with optional native setup. The supplied code does not generate or modify Android projects at all; it is a test file validating another module's detection and recommendation logic. While some tested areas overlap thematically with the description—such as Gradle/JDK compatibility, assemble/build readiness assessment, and JNI/NDK-related handling—the actual code chunk’s primary purpose is automated testing of environment detection and recommendation functions, not project generation or build configuration. That is a materially different behavior, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about Android project scaffolding and build configuration, especially Gradle and optional native Android setup. The supplied code chunk does none of that. It is purely a Python regression test file for internal test/report scripts, covering pytest output parsing, JSON summary persistence, HTML report generation, path formatting, dependency checks, and subprocess-based report-only test execution. This is a materially different primary purpose and capability set, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- `SKILL.md`, `README.md`, `LICENSE`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

- `SKILL.md`, `README.md`, `LICENSE`

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown skill content appears to require Chinese comprehension for all usage, but it does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_flow.py (reported line 27)May include surrounding context.

python

command = choose_gradle_command(project_dir, platform)

    try:
        result = subprocess.run(
            command,
            cwd=str(project_dir),
            capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

ADB provides control over connected devices, and this script includes that capability even though the stated purpose is project generation and compile validation. In this context, the extra capability expands the blast radius from local build operations to modifying device state, making misuse or accidental execution more dangerous.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_flow.py (reported line 53)May include surrounding context.

python

"""执行 adb 命令。"""
    command = ["adb", *args]
    try:
        result = subprocess.run(
            command,
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exceeds passive project generation/build validation by installing and launching an APK on a connected device or emulator. That crosses into active device manipulation and code execution on an external target, which is risky for a generator-oriented skill and could lead to unintended app deployment or execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script installs an APK onto whatever device or emulator adb currently targets without any interactive warning or confirmation. This can alter a real device unexpectedly, overwrite an installed app with -r, and deploy unreviewed code beyond the local development environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Launching the app's main activity on the connected device/emulator without warning causes unsolicited execution on the target device. That may trigger network access, permission prompts, background actions, or user-disruptive behavior, especially if the generated or modified app content is not fully trusted.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/detect_env.py (reported line 47)May include surrounding context.

python

def run_command(cmd: list) -> tuple:
    """运行命令并返回 (returncode, stdout, stderr)"""
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module title and function docstrings are written in Chinese, which imposes a specific language on users and maintainers without any opt-in or documented locale constraint. The policy requires either user choice or a clearly justified language restriction, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document title and the entire README are written in Chinese, and no alternative language option or opt-in is provided. Per the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/e2e/test_e2e_compilation.py (reported line 54)May include surrounding context.

python

def check_jdk_version() -> Optional[int]:
    """检查当前 JDK 版本"""
    try:
        result = subprocess.run(
            ["java", "-version"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 81% confidence

Finding

This code executes gradlew from a project directory that is programmatically created and may later be populated from an external wrapper template path (E2E_WRAPPER_TEMPLATE). Running build scripts and wrappers is equivalent to executing code, and if the wrapper or project contents are attacker-controlled, this can lead to arbitrary code execution on the CI runner or developer machine.

Content

Scanner excerpt · tests/e2e/test_e2e_compilation.py (reported line 103)May include surrounding context.

python

raise FileNotFoundError(f"gradlew not found at {gradlew}")
    
    try:
        result = subprocess.run(
            [str(gradlew), "assembleDebug", "--no-daemon"],
            cwd=str(project_path),
            capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language descriptions only in Chinese, including the module docstring that describes the tool's purpose. Under the policy, forcing a specific language without user opt-in or documented justification is a locale-policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a skill for generating and configuring Android projects, including Gradle/JNI/NDK setup and build-readiness validation. This file instead executes Python test suites by spawning pytest in a subprocess, which is a distinct capability unrelated to Android project generation and broader than simple project validation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/generate_report.py (reported line 111)May include surrounding context.

python

print(f"\n[CMD] Running: {' '.join(cmd)}")
    
    # 运行测试
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,

Static analysis

No suspicious patterns detected.