Android Unused Resource Cleanup

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:15 PM UTC
• Version: 0.1.0

Overview

This skill is a disclosed Android repository analysis helper that reads Git diffs and project resource files, then prints deletion suggestions without deleting anything itself.

Install only if you are comfortable with a local helper reading source and resource files under the Android project you point it at. Treat its output as suggestions: it prints delete commands but does not delete files, so review the listed resources and build/test the project before removing anything.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs users to run a local Python script and use Git diff data, which implies shell execution and file access, but it declares no explicit tool scope or permissions. That creates an avoidable trust gap: an agent may execute broader file or shell operations than reviewers expect, increasing the chance of unintended repository access or command execution if the implementation changes or is invoked in a permissive environment.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing natural-language content entirely in Chinese, including the description, usage guidance, and warnings. Under the policy rule, forcing a specific language without user choice is a locale/language policy violation unless explicitly justified or optionality is provided.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python skill includes its top-level description and subsequent user-facing CLI/help text in Chinese, which effectively forces a specific language for interaction. The file does not indicate that the tool is region-specific or provide any opt-in or alternative language choice, which matches the language/locale policy violation criteria.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_git_diff(self, commit_range: str = "HEAD~1") -> str:
        """获取 Git diff 内容"""
        try:
            result = subprocess.run(
                ['git', 'diff', commit_range],
                cwd=self.project_root,
                capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_staged_changes(self) -> str:
        """获取已暂存的改动"""
        try:
            result = subprocess.run(
                ['git', 'diff', '--cached'],
                cwd=self.project_root,
                capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_unstaged_changes(self) -> str:
        """获取未暂存的改动"""
        try:
            result = subprocess.run(
                ['git', 'diff'],
                cwd=self.project_root,
                capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.