Phone agent

Use AI AutoGLM Phone Agent for automated mobile device control. Suitable for tasks requiring mobile phone automation, such as APP automated testing, data col...

Security Scan

The skill's instructions match a phone-automation purpose, but its registry metadata omits required runtime pieces (adb and PHONE_AGENT_ENDPOINT) and the skill asks the agent to control a live device — verify missing declarations and the SDK source before use.

Purpose & Capability

The SKILL.md describes legitimate mobile automation capabilities (tap, swipe, screenshots) consistent with the stated purpose. However, the registry metadata declares no required binaries or env vars while the instructions explicitly require adb in PATH, the AutoGLM Phone Agent SDK, and an endpoint exposure (PHONE_AGENT_ENDPOINT). The mismatch between declared requirements and actual runtime needs is a material incoherence.

Instruction Scope

The instructions stay inside the stated domain: they direct the agent to interact with an AutoGLM Phone Agent backend and an Android device via adb and the SDK. They do not instruct the agent to read unrelated host files or secrets. They do, however, require the agent to be able to reach a local HTTP service and to perform real UI actions on a connected device, which is expected for this skill but carries device-level risk.

Install Mechanism

This is an instruction-only skill with no install spec or code files, which reduces filesystem/install risk. The SKILL.md references installing an external SDK and running its agent, but the skill itself does not pull or install code — the user/administrator must install the SDK separately.

Credentials

The runtime instructions require environment configuration (PHONE_AGENT_ENDPOINT) and adb availability, but these are not declared in the skill metadata (requires.env and required binaries are empty). While the skill does not request cloud credentials or secrets, it does ask the operator to grant overlay/accessibility permissions on devices — appropriate for automation but sensitive. The missing declarations reduce transparency about what the skill will need access to.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or global agent settings. Model invocation is allowed (default), which is normal for skills that perform actions; combined with the ability to control a device this increases blast radius but is expected for an automation skill.

What to consider before installing

This skill appears to do what it says (drive an Android device through a local AutoGLM Phone Agent), but its registry metadata omits important runtime requirements. Before installing or invoking it: - Treat it as able to perform ANY UI action on a connected device. Use only test devices/accounts and never a personal device with sensitive data. - The SKILL.md expects adb in PATH and an env var PHONE_AGENT_ENDPOINT pointing at a locally running Phone Agent service—ask the publisher to add these to the declared requirements, or set them manually in a controlled environment. - Verify the AutoGLM Phone Agent SDK you install is from a trusted source (the README points to https://github.com/zai-org/Open-AutoGLM; confirm repository authenticity and review its code). - Run the SDK and test commands manually (adb devices, curl the endpoint) before letting the agent invoke the skill autonomously. - Be careful granting overlay/accessibility permissions on devices; those permissions allow broad UI control and can be abused. If the publisher cannot or will not update the metadata to list required binaries and the PHONE_AGENT_ENDPOINT env var, treat the omission as a red flag and prefer manual, sandboxed testing only.

AutoGLM Phone Agent Skill

This skill lets Codex drive an Android device through the AutoGLM Phone Agent SDK: tap, type, swipe, scroll, launch apps, take screenshots, and read UI text. It is aimed at automation tasks such as end-to-end testing, data collection, or reproducing user journeys.

Prerequisites

• An Android device or emulator with developer mode and USB debugging enabled.
• adb available in the path and the device showing up in adb devices.
• AutoGLM Phone Agent SDK installed (see upstream docs: https://github.com/zai-org/Open-AutoGLM).
• A running Phone Agent backend (start the agent service provided by the SDK before using the skill).

Setup

1. Connect the device and verify connectivity: adb devices should list at least one device as device.
2. Follow the SDK guide to start the Phone Agent service (typically binds to a host/port on your machine). Note the service URL.
3. Expose the service URL to the agent runtime, for example by setting PHONE_AGENT_ENDPOINT=http://127.0.0.1:5000 (adapt to your actual host/port).
4. Grant the device the needed permissions (overlay/accessibility) when prompted by the SDK so that taps and text entry succeed.

How to Use

• Describe high-level goals; the agent decomposes them into UI steps.
• Include app names or on-screen text to anchor actions (e.g., "open Settings, search for 'Wi‑Fi', toggle it off").
• Ask for confirmation screenshots when changes are risky.

Example prompts the skill handles well:

• "Open the Play Store, search for 'Signal', and share the first result link back."
• "In the Twitter app, open settings → Privacy and turn off location precision, then send me a screenshot of the toggle state."
• "Launch our test app, log in with the provided test account, and capture the purchase confirmation screen."

Outputs

• Action logs (tap/swipe/type), screenshots, and structured observations returned by the SDK.
• Errors from the backend are surfaced directly so you can troubleshoot quickly.

Troubleshooting

• If commands hang, confirm the Phone Agent service is reachable at PHONE_AGENT_ENDPOINT and that the port is not firewalled.
• If taps land in the wrong place, recalibrate the device resolution in the SDK or restart the accessibility service.
• If no device is detected, reconnect USB, ensure adb has permission, and rerun adb devices.

Safety and Limits

• The skill executes real UI actions—use only on test devices or accounts when possible.
• Avoid tasks that require biometric auth; the SDK cannot bypass hardware prompts.
• Network-dependent steps may vary by region or app version; provide explicit fallbacks when reliability matters.

Changelog

• 1.0.0: Initial publication with setup, usage guidance, and troubleshooting notes for the AutoGLM Phone Agent.