Is .skills/media safe?
https://github.com/sunnat629/android-media-pack/tree/main/.skills/media
This skill pack is a comprehensive Android Media3 SDK guidance collection comprising 20+ sub-skills covering playback, UI, DRM, streaming, migration, and testing. The content is entirely legitimate developer documentation with security-conscious authoring (e.g., explicit rules against logging tokens, DRM best practices). The only meaningful risk is a bundled shell migration script (rewrite-imports.sh) that performs bulk in-place file replacements — if an agent invokes it autonomously with filesystem tools it could modify source files without user confirmation. Canary file reads observed during the audit window are attributable to the monitoring infrastructure's pre/post-install integrity checks, not the skill itself. No prompt injection, data exfiltration, or malicious clone behavior was detected.
Category Scores
Findings (5)
LOW Shell migration script capable of bulk in-place file modification -18 ▶
The file rewrite-imports.sh performs find + xargs sed -i across .kt and .java source files to replace ExoPlayer 2.x imports with Media3 equivalents. While documented as a manual migration helper, if an LLM agent with shell execution tools treats this as a runnable artifact it could silently rewrite source files across the entire project without user confirmation. The script deletes its .bak backups after completion, making changes harder to undo.
LOW Canary file reads detected during monitoring period -10 ▶
Auditd recorded open/read syscalls against all six canary files (.env, id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) twice during the audit window. Timing and sequential millisecond access pattern strongly indicate monitoring infrastructure performing baseline and post-install integrity sweeps rather than skill-driven reads. All files confirmed intact by the monitoring system. No network activity correlating to credential transmission was observed.
INFO External documentation URLs referenced in skill content -4 ▶
The streaming-media-architecture SKILL.md includes a Sources section listing eight URLs (developer.android.com and github.com). These are all legitimate public Android developer resources. An agent might attempt to fetch these to supplement its response, which is low-risk but represents an external dependency not visible to the user without reading the full skill content.
INFO No data exfiltration vectors found in skill content 0 ▶
All 20+ SKILL.md files and reference documents contain only API guidance, code examples, and architectural recommendations. No instructions to read files, send HTTP requests with user data, encode output, or access any local resources. The rewrite-imports.sh script reads only .kt/.java files within a user-specified directory and writes back to those same files — no network transmission.
INFO Clean sparse checkout from public GitHub repository 0 ▶
The installer performed a standard git clone --depth 1 with sparse checkout to isolate only the .skills/media subpath. The only external connection was to github.com (140.82.121.4:443). The temporary clone directory was removed after installation. No unexpected processes were spawned.