ClawHub
Back to skill

Security audit

Android Project Generator

Security checks across malware telemetry and agentic risk

Overview

This Android skill runs local build and optional device-verification commands, but the behavior is disclosed and aligned with generating buildable Android projects.

Install only if you are comfortable with a skill that runs local Android build tools, may download Gradle/dependencies, and can use adb to install and launch a generated debug APK. Prefer an emulator or sandbox for runnable verification, review generated projects and Gradle wrappers before building untrusted code, and avoid opening generated HTML reports in sensitive browser contexts if third-party CDN loading is a concern.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
raise FileNotFoundError(f"gradlew not found at {gradlew}")
    
    try:
        result = subprocess.run(
            [str(gradlew), "assembleDebug", "--no-daemon"],
            cwd=str(project_path),
            capture_output=True,
Confidence
84% confidence
Finding
This code executes `gradlew` from a generated project directory, and the project creation helper explicitly writes a placeholder `gradlew` shell/batch script. If an attacker can influence project contents or path selection, this becomes arbitrary local code execution during tests or automation because the wrapper script is treated as trusted and executed directly.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to read environment variables, write project files, and execute local shell commands, yet there is no declared permissions model or user-consent boundary in the metadata. This is dangerous because an agent or reviewer may underestimate the operational access the skill requires, leading to unintended command execution, filesystem modification, or environment inspection on sensitive hosts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented purpose is Android project generation and build validation, but the analyzed behavior reportedly extends into device installation/launch, pytest execution/report generation, opening browser reports, and Python runtime/cache utilities. Behavior outside the declared scope increases the chance of unexpected side effects and makes it harder for users to give informed consent, especially where browser launch, device control, or unrelated test/runtime manipulation is involved.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The generated HTML imports JavaScript from a third-party CDN at runtime, which creates a supply-chain and privacy risk: anyone viewing the report executes unpinned remote code in their browser. Even though this is a test-report utility rather than production app code, the report may be opened in developer or CI environments, so compromise of the CDN or dependency could lead to script execution, data exfiltration, or report tampering.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code can install an APK onto a connected Android device and launch its activity automatically, with no built-in confirmation, safety prompt, or trust boundary check. In a skill that generates and builds projects, this increases risk because the generated or modified app may not be fully trusted, and automatic deployment affects an external device rather than just the local workspace.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.