Atlas / Skills / android / Camera1 To Camerax

Camera1 To CameraxBLOCK

skills/android/camera1-to-camerax
Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
3 documented
License
Apache-2.0
Stars
9,545
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Android skills

Android skills are a dedicated repository of AI-optimized, modular instructions and resources, to help agents better understand and execute specific patterns that follow the best practices and guidance on Android development from developer.android.com.

Android skills follow the open-standard agent skills - markdown files (SKILL.md) that provide a technical specification of a task, and ground LLMs with information on specialized domains and workflows.

Our Android skill development focuses on use cases and workflows where evaluations show LLMs underperform. We aren't prioritizing well-established areas where LLMs are already proficient, such as basic Jetpack Compose best practices.

To learn more, read the official documentation:

Install Android skills

Use Android CLI to install a specific skill into the current directory:

android skills add r8-analyzer --project=.

Use Android CLI to install all Android skills to directories for all detected agents:

android skills add --all

If you don't have any existing agent directories and don't specify particular agents, the skills will be installed for Gemini and Antigravity at ~/.gemini/antigravity/skills.

Options:

  • --all - Add all Android skills. If omitted, only the android-cli skill will be installed.
  • --agent - A comma-separated list of agents to install the skill for. If omitted, the skill will be installed for all detected agents.
  • --project - Path to a project root in which to install the skills.

To update all skills or specific ones, run:

android skills update --all
android skills update wear-compose-m3

Install as an agent plugin

**Claude Code

Read from source at commit 6c14d01899d6OBSERVED · 2026-10-24
Advertisement
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
codexmentioned
cursormentioned
03

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: camerax
description: Provide technical guidance for Android camera development with CameraX.
  Use when implementing camera features, handling asynchronous recording lifecycles,
  wiring low-level hardware interop using CameraX, or integrating ML Kit or Media3
  effects.
license: Complete terms in LICENSE.txt
metadata:
  author: Google LLC
  last-updated: '2026-10-08'
  keywords:
  - recipe
  - Android
  - Camera
  - Camera1
  - Camera2
  - CameraX
  - migration
  - Compose
  - guide
  - dependencies
  - PreviewView
  - CameraXViewfinder
  - ImageCapture
  - VideoCapture
  - ImageAnalysis.
---

This skill provides procedural guidance and standard patterns for building
camera applications on Android, with a focus on CameraX, including its
`Camera2Interop` utilities, and Media3 integrations.

## Core workflows

### Handling immutable API patterns

Various Android camera and media APIs, especially CameraX `VideoCapture`, use a
**fluent, immutable builder-like pattern** where methods return a new instance.
Failing to reassign these results in settings, such as audio, being ignored.

**Pattern: Reassignment is required**


```kotlin
// WRONG
run {
  val pending = recorder.prepareRecording(context, opts)
  pending.withAudioEnabled() // This returns a new instance which is ignored
  val active = pending.start(exec, listener)
}

// CORRECT
run {
  val pending = recorder.prepareRecording(context, opts)
      .withAudioEnabled() // Chaining works
  val active = pending.start(exec, listener)
}

// ALSO CORRECT
run {
  var pending = recorder.prepareRecording(context, opts)
  pending = pending.withAudioEnabled() // Reassignment
  val active = pending.start(exec, listener)
}
```

<br />

See [immutability](references/immutability.md) for a list of affected classes.

### Migrating to CameraX

When migrating legacy camera codebases to the CameraX Jetpack library:

- **Camera1 to CameraX** : For migrating legacy `android.hardware.Camera` implementations, surface handling, and manual lifecycles, see the [Camera1 migration guide](references/camera1-to-camerax.md).
- **Camera2 to CameraX** : For migrating more recent but verbose `android.hardware.camera2` implementations, session state callbacks, and interop patterns, see the [Camera2 migration guide](references/camera2-to-camerax.md).

### Comprehensive feature blueprinting

For multi-step features that involve multiple files and hardware-level wiring,
follow the [Structural Blueprinting](references/expert-blueprints.md) approach to avoid
system timeouts. Such complex features include:

- **Manual controls** : Break down into the `ViewModel` state, the controller layer, and the `Camera2Interop` wiring in the session.
- **RAW capture**: Separate JPEG and RAW output configurations into discrete build steps.
- **Custom effects** : Prefer `Media3Effect` or `SurfaceProcessor` over manual OpenGL pipelines unless absolute performance is required.
- **Low-light** : See [low-light](references/low-light.md) for Night Mode and LLB guidance.
- **Foldables** : See [foldables](references/foldables.md) for handling dynamic postures and hinge states.
- **XR, AR, and VR** : See [xr](references/xr.md) for spatial tracking, passthrough synchronization, and latency guardrails.
- **Thermals and power** : See [thermals](references/thermals.md) for managing `StreamUseCase` optimizations and `PowerManager` thermal states.
- **Testing and mocking** : See [testing](references/testing.md) for using `FakeCameraConfig`, handling asynchronous lifecycles, and validating analysis pipelines.
- **ML Kit spatial analysis** : See [mlkit-spatial](references/mlkit-spatial.md) for coordinate mapping, rotation logic, and mirrored lens handling.
- **Wear OS camera remote** : See [wear-os](references/wear-os.md) for circular UI constraints, Data Layer API syncing, and remote trigger logic.

See [expert-blueprints](references/expert-blueprints.md) for step-by-step guides.

### API discovery

Always use higher-level abstractions instead of low-level manual wiring:

- **Analysis** : Use `MlKitAnalyzer` instead of manual `ImageAnalysis.Analyzer`.
- **Filters and effects** : Use `Media3Effect` for standard post-processing.
- **Multi-camera** : Use `ConcurrentCamera` APIs for dual-stream setups.

See [modern-apis](references/modern-apis.md) for current recommendations.

### Code quality and architectural rules

Adhere to the following Android ecosystem standard patterns when building your
camera implementations:

- **Testing, fakes over mocks** : Avoid mocking libraries like `Mockito`, especially for multi-step CameraX interfaces like `ImageProxy`. Build "Fakes" to verify state rather than unreliable implementation details.
- **Google Truth assertions** : Use `assertThat` over standard `JUnit` assertions like `assertEquals` for improved readability.
- **Explicit test runners** : Always define an explicit `@RunWith` for test classes to ensure the CI environment executes them correctly.
- **Semantic UI merging** : When building custom camera controls in Compose, such as a button with an `Icon` and `Text`, use `semantics {
  mergeDescendants = true }` to ensure screen readers announce them as a single, coherent unit.

## Hardware and device diversity

Camera apps run on a wide variety of hardware, from mobile phones and
foldables to tablets, laptops, and even smart appliances. Have consideration
for the specific hardware the app is running on.

- **Form factors**: Account for screen size and orientation changes on foldables and tablets.
- **Multi-camera arrays**: Some devices have a rear-facing camera and a front-facing camera. Other devices have multiple rear-facing cameras, such as wide-angle and telephoto lenses.
- **Feature parity**: Features like flash or auto-focus behave differently across hardware. For example, CameraX handles both physical flash, back, and screen-based flash, front, and both must be considered when implementing flash functionality.

## Common pitfalls

- **Asynchronous l
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (4 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (16)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
identity/restore-credentials/SKILL.md:144
2. [**Get credential creation options from the app server**](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API): Send the client app the details required to create the restore ke
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
identity/restore-credentials/SKILL.md:146
4. [**Handle the credential creation response**](https://w3c.github.io/webauthn/#dictdef-publickeycredentialrequestoptionsjson): Send the credentials from your client app to your app server for proces
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
identity/restore-credentials/SKILL.md:148
1. [**Get credential retrieval options from the app server**](#get-credential-retrieval): Send the client app the details required to retrieve the restore key from your app server.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
identity/restore-credentials/SKILL.md:150
3. [**Handle the credential retrieval response**](#handle-sign-in): Send the restore key from the client app to the app server to sign in the user.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
HIGHPrompt injection · prompt.read_system · CWE-94, CWE-1427
play/play-policy-insights/SKILL.md:115
complete. Pass the prompt: `"Read your instructions from
HIGHPrompt injection · prompt.read_system · CWE-94, CWE-1427
play/play-policy-insights/SKILL.md:135
`"Read your instructions from <temp_dir>/prompt_critic_<i>.md and execute. MANDATORY: You must use your file-writing capabilities to save your final JSON findings directly to the file system at <temp_
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
play/play-policy-insights/scripts/generate_report.py:805
" exfiltration was detected. These typically do not require a"
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
cars/android-for-cars-parked-apps/references/android/docs/quality-guidelines/car-app-quality/index.md:189
| Templated Messaging Functionality | `TMF-1` | Messaging (templated) | The app displays conversations as described in [Display conversations](https://developer.android.com/training/cars/communication
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
cars/android-for-cars-parked-apps/references/android/docs/quality-guidelines/car-app-quality/index.md:108
| Sensitive Data | `SD-1` | Browsers | Browsers must not save or allow access to passwords or payment information unless the [user can block access to passwords](https://developer.android.com/training
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
cars/android-for-cars-parked-apps/references/android/docs/quality-guidelines/car-app-quality/index.md:542
Browsers must not save or allow access to passwords or payment
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
cars/android-for-cars-parked-apps/references/android/docs/quality-guidelines/car-app-quality/index.md:543
information unless the user can block access to passwords using a
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
identity/verified-email/references/android/identity/digital-credentials/index.md:16
- **Interoperability**: By following open standards, digital credentials can work across different operating systems, devices, and platforms.
Why it matters. asks the agent to read credentials
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
devtools/android-cli/SKILL.md:33
- Linux x86-64: curl -fsSL https://dl.google.com/android/cli/latest/linux_x86_64/install.sh \| bash
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
devtools/android-cli/SKILL.md:34
- Linux ARM64: curl -fsSL https://dl.google.com/android/cli/latest/linux_arm64/install.sh \| bash
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
devtools/android-cli/SKILL.md:35
- Mac Arm: curl -fsSL https://dl.google.com/android/cli/latest/darwin_arm64/install.sh \| bash
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
devtools/android-cli/SKILL.md:36
- Mac Intel: curl -fsSL https://dl.google.com/android/cli/latest/darwin_x86_64/install.sh \| bash

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

Audited 2026-10-24 · audit v0.4.1 · source sha 6c14d01899d6full audit observations/trust-audit/skill/android__camera1-to-camerax.json · Report an issue / request a re-scan
05

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-246c14d01899d6BLOCKD69first audit
06

Questions

Is camera1-to-camerax — android/skills safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What can camera1-to-camerax — android/skills access on my machine?

The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.

Which assistants does camera1-to-camerax — android/skills work with?

Its documentation mentions claude-code, codex and cursor. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (6c14d01899d6), read on 2026-10-24. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Camera1 To Camerax](https://modelsatlas.com/skills/android/camera1-to-camerax/badge.svg)](https://modelsatlas.com/skills/android/camera1-to-camerax/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement