google-tv-button-remap

• Outcome: Review
• Latest audit: Oct 15, 2026 · 6:14 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it uses powerful Android accessibility and ADB settings changes in a way users should review carefully before installing.

Install only if you are comfortable granting an accessibility service the ability to intercept hardware key events. Before running the ADB settings commands, record the current enabled accessibility services and use a component-specific enable/disable method so other services are not removed. Prefer reviewing or rebuilding the APK yourself, and remove QUERY_ALL_PACKAGES unless you truly need arbitrary app discovery.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Accessibility enablement and removal commands overwrite the device-wide service list

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:82-87
Additional Locations: references/app-button-remap.md:79-84, docs/rcu-app-button-remap.md:123-126, docs/rcu-app-button-remap-engineering.md:310-312
Vulnerability Type: Destructive replacement of shared accessibility configuration
Risk Level: Medium

Complete Code Snippet

bash

adb install --no-incremental app-release.apk
adb shell settings put secure enabled_accessibility_services <pkg>/<pkg>.RemapService
adb shell settings put secure accessibility_enabled 1

The documented undo operation is:

bash

adb shell settings put secure enabled_accessibility_services ''

Technical Analysis

enabled_accessibility_services is a shared secure setting containing the complete list of enabled accessibility-service components. The documented settings put commands replace that entire value.

The installation command does not merge the remapper component into the existing list. Consequently, enabling the remapper through this procedure removes any previously enabled accessibility services. Likewise, the undo command clears the complete list rather than removing only the remapper.

The modification therefore exceeds the scope implied by enabling or disabling this individual service. Although the remapper legitimately needs accessibility access and the operation is disclosed, the instructions do not preserve unrelated device configuration. No evidence shows malicious intent.

Attack Path

1. A device already has one or more accessibility services enabled, such as assistive technology or another user-selected automation or security service.
2. The user asks the agent to install and enable the button-remapping Skill.
3. The agent follows the documented command:

   bash

   adb shell settings put secure enabled_accessibility_services <pkg>/<pkg>.RemapService
   

4. Android replaces the complete enabled-service list with only the remapper component.
5. Existing accessibil ...[truncated 818 chars]

Remediation

View remediation

Remediation Suggestions

Prefer directing the user to Android's Accessibility Settings so the service is enabled or disabled explicitly through the platform UI.

If ADB automation is required:

1. Read the current enabled_accessibility_services value.
2. Parse it as a colon-separated component list.
3. Add the remapper component only if it is absent.
4. Write back the merged list without changing unrelated entries.
5. During removal, delete only the remapper component.
6. Disable the global accessibility_enabled flag only when no accessibility services remain.
7. Verify the resulting list and report the exact change to the user.

Replace the blanket undo command with a component-specific removal procedure. Apply the same correction consistently in SKILL.md and all referenced documentation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about runtime behavior on Google TV: intercepting a remote button through accessibility mechanisms and launching another app. The provided code does not implement any of that functionality. It is purely a build script for creating a signed APK from source and resources. While build infrastructure can be a supporting detail in a project, this code chunk itself does not reflect the declared primary purpose and instead performs a materially different task: packaging/signing the app. No evidence of button capture, accessibility filters, remote input handling, or app launching appears in this snippet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the user to enable an AccessibilityService that filters hardware key events, but it does not present a strong, explicit warning about the privacy and abuse potential of accessibility privileges before enabling it. Accessibility services are highly sensitive on Android because they can observe user interaction broadly, and normalizing their use for remapping can condition users to grant powerful permissions without adequate risk disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest requests QUERY_ALL_PACKAGES, which grants visibility into essentially all installed apps on the device. For a button-remapping app, this is broader than necessary and can expose user app inventory for tracking, profiling, or misuse if the app or a future update is compromised. The accessibility-service context increases sensitivity because the app already operates with elevated user-trust and system-interaction capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs users to enable an AccessibilityService and modify secure settings via adb, but does not warn that accessibility services can observe user input, control UI flows, and broadly affect device behavior. In this context, the skill is explicitly about intercepting hardware key events and suppressing stock behavior, so omitting privacy and device-control warnings meaningfully increases the risk of misuse or unsafe deployment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/build-apk-without-gradle.md (reported line 8)May include surrounding context.

One-time toolchain

bash

sudo apt-get install -y openjdk-17-jdk-headless unzip zip curl
# Unpack Android command-line tools to $SDK/cmdline-tools/latest, then:
export SDK=$HOME/android-sdk
yes | "$SDK/cmdline-tools/latest/bin/sdkmanager" --sdk_root="$SDK" --licenses

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to enable an accessibility service directly via shell commands, bypassing normal user-facing consent flows and omitting any warning about the extensive capabilities accessibility services have. In this skill’s context, that is especially sensitive because the service is explicitly intended to capture key events and remap remote buttons, which can enable broad input monitoring and device-control behavior if repurposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 6% confidence

Finding

I found no natural-language instruction that forces a specific language or locale on the user. The only SQP-3 policy area in scope is language/locale policy, and this file does not appear to violate it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.