open-autoglm-phone-agent

github.com/aradotso/trending-skills
Verdict: Proceed with caution
0 critical0 high8 medium
C
SCORE 55 / 100
$skillox install open-autoglm-phone-agentSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade C?

score · 55 / 100

The current grade reflects 8 medium findings (6+ MEDs → C).

0 CRIT0 HIGH8 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 3 of 8 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 6 of 8 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-nhmr0cs2eq3lcwof9o6hgbdo · Thu, 28 May 2026 17:12:22 GMT · 2ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 301CWE-78
▾
299 cmd.extend(["-s", device_id])
300 cmd.extend(["exec-out", "screencap", "-p"])
301 result = subprocess.run(cmd, capture_output=True)← spawns a subprocess outside declared capabilities
302 return result.stdout
303
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 310CWE-78
▾
308 cmd.extend(["-s", device_id])
309 cmd.extend(["shell", "input", "tap", str(x), str(y)])
310 subprocess.run(cmd)← spawns a subprocess outside declared capabilities
311
312def send_text_adb_keyboard(text: str, device_id: str = None):
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 319CWE-78
▾
317 # Enable ADB keyboard first
318 cmd_enable = cmd + ["shell", "ime", "set", "com.android.adbkeyboard/.AdbIME"]
319 subprocess.run(cmd_enable)← spawns a subprocess outside declared capabilities
320 # Send text
321 cmd_text = cmd + ["shell", "am", "broadcast", "-a", "ADB_INPUT_TEXT",
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 323CWE-78
▾
321 cmd_text = cmd + ["shell", "am", "broadcast", "-a", "ADB_INPUT_TEXT",
322 "--es", "msg", text]
323 subprocess.run(cmd_text)← spawns a subprocess outside declared capabilities
324
325def swipe(x1: int, y1: int, x2: int, y2: int, duration_ms: int = 300, device_id: str = None):
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 332CWE-78
▾
330 cmd.extend(["shell", "input", "swipe",
331 str(x1), str(y1), str(x2), str(y2), str(duration_ms)])
332 subprocess.run(cmd)← spawns a subprocess outside declared capabilities
333
334def press_back(device_id: str = None):
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 340CWE-78
▾
338 cmd.extend(["-s", device_id])
339 cmd.extend(["shell", "input", "keyevent", "KEYCODE_BACK"])
340 subprocess.run(cmd)← spawns a subprocess outside declared capabilities
341
342def launch_app(package_name: str, device_id: str = None):
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 349CWE-78
▾
347 cmd.extend(["shell", "monkey", "-p", package_name, "-c",
348 "android.intent.category.LAUNCHER", "1"])
349 subprocess.run(cmd)← spawns a subprocess outside declared capabilities
350```
351
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/open-autoglm-phone-agent