agent-android is pre-1.0 and moves quickly. Security fixes land on the latest released version and main. Older 0.x releases are not maintained - please update to the newest version before reporting.

Please do not open a public issue for security problems.

Report privately to security@squaduplabs.com. Include:

• a description of the issue and its impact,
• steps to reproduce (a proof of concept if you have one),
• affected version (agent-android --version) and your OS / adb versions.

You can expect an acknowledgement within a few business days. Once a fix is available we will coordinate a release and credit you in the release notes unless you prefer to remain anonymous.

If the project is hosted on GitHub, you may also use private vulnerability reporting on the repository.

agent-android is a local developer tool. It:

• runs on your machine and drives Android emulators or devices you have connected,
• shells out to adb (uiautomator, input, screencap, am, pm) over your existing adb connection - it starts no network server of its own,
• stores per-device state (snapshot refs, session app) under ~/.agent-android.

Things we consider in scope: command injection through arguments passed to the device shell, or the tool writing outside its expected directories. Things generally out of scope: risks that require an attacker to already have local code-execution on your machine, the security of the adb transport itself, and the behavior of the emulators or apps you point it at.