Skip to content

v0.1.1 — Security and Distribution Hardening

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 17:12
· 1 commit to main since this release
v0.1.1
ec90d5e

v0.1.1 — Security and Distribution Hardening

This release hardens the existing Android black-box analysis workflow without expanding its authorization scope.

Changes

  • Documents the trust boundary around untrusted app-rendered text, ADB output, case files, contributions, dependencies, and release assets.
  • Neutralizes formula-like UI text before writing CSV indexes.
  • Rejects unsafe package names, case roots, symlinks, oversized UI/text input, and unbounded sweep or wait parameters.
  • Adds negative tests for injection-shaped UI content, hostile arguments, symlink escapes, credential patterns, and resource exhaustion.
  • Adds deterministic installable ZIP packaging and a SHA-256 checksum.
  • Adds CodeQL/Dependabot configuration, CODEOWNERS, and structured public intake forms that prohibit private evidence.

Verification

  • ./scripts/smoke_test.sh
  • ./tests/security_negative_test.sh
  • node ./scripts/validate_skill.mjs .
  • node ./scripts/validate_example.mjs ./examples/sanitized-complete-example
  • node ./scripts/redact_check.mjs .
  • unpacked release archive validation on macOS and GitHub Actions Ubuntu 24.04

Known limits

CI validates scripts and synthetic fixtures, not every Android device, distribution, renderer, or third-party application. Redaction remains heuristic and cannot inspect sensitive pixels. ADB is privileged and must be restricted to explicitly authorized devices and networks. No third-party public adoption is claimed by this release.

Installation

Download both release assets, verify the checksum, and extract the ZIP into the active Codex Skills directory. Git-based installation remains supported.

Assets 4
Loading