Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

r8-analyzer

skill · android/skillsApache-2.0 licenceAudited 31 Oct 2026 · source ba2d4bc1b905

★ 10,110pushed 1 day ago
✓SAFEGrade B · 89/100 · 31 Oct 2026 · ba2d4bc
10,110repo stars · whole android/skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit ba2d4bc1b905 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Analyzes Android build files and R8 keep rules to identify redundancies,

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “r8-analyzer (android/skills)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/android/r8-analyzer

Trust audit

Audit 0.4.1 · source read 31 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha ba2d4bc1b905 · 31 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherandroid GitHub organizationOwner of the repository this skill is read from
  • Source folderandroid/skills/performance/r8-analyzerThe exact folder we audited
  • LicenceApache-2.0As the repository states it
  • Commit pinned for this verdictba2d4bc1b905A new audit runs when the source changes
  • Repository statusNot archivedLast push 1 day ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Analyzes Android build files and R8 keep rules to identify redundancies,

---
name: r8-analyzer
description: Analyzes Android build files and R8 keep rules to identify redundancies,
  broad package-wide rules, and rules that subsume library consumer keep rules. Use
  this skill when developers want to optimize their Android app's size, remove redundant
  or overly broad keep rules, or troubleshoot ProGuard configurations. Don't use for
  general Gradle build errors, Compose UI performance, or runtime CPU profiling.
license: Complete terms in LICENSE.txt
metadata:
  author: Google LLC
  last-updated: '2026-10-24'
  keywords:
  - R8
  - proguard
  - keep rules
  - app size
  - optimization
  - shrinking
  - minification
  - obfuscation
---

## Step 1. Setup and configuration check

- Inspect `build.gradle`, `build.gradle.kts`, and `gradle.properties`.
- Use [references/CONFIGURATION.md](references/CONFIGURATION.md) to identify missing optimizations.
- **AGP** : If the version is lower than 9.3, suggest migration to 9.3 for the simplified [`optimization {}` DSL](references/android/topic/performance/app-optimization/enable-app-optimization.md) and the Configuration Analyzer task.
- **Full mode** : Verify `android.enableR8.fullMode=false` is removed from the `gradle.properties` file.

## Step 2. Analysis path selection

- Inspect `build.gradle`, `build.gradle.kts`, `settings.gradle`, `settings.gradle.kts`, `gradle.properties`, and `libs.versions.toml` to get the AGP and R8 versions. An R8 version pinned in `settings.gradle(.kts)` replaces the R8 bundled with AGP.
- Find the app module (usually `app`) and a build variant with R8 enabled (usually `release`). The following commands use them as `<module>` and `<Variant>`, for example `:app:minifyReleaseWithR8`.
- The helper scripts are in this skill's `scripts/` directory. In the following
  commands, `<skill_dir>` is this skill's directory. Run every command from the
  project root.

- **If AGP \>= 9.3.0** : Proceed to **Path A (Standalone Task)**.

- **If AGP \< 9.3.0** : Proceed to **Path B (Quantitative)**.

### Path A: Standalone Gradle task (AGP \>= 9.3.0)

- **Step 1: Check requirements** : Python and the `protobuf` package 6.33.4 or later are mandatory (used by [`scripts/keep_radius_pb2.py`](scripts/keep_radius_pb2.py)). Install it with `pip install "protobuf>=6.33.4"`; versions lower than 6.33.4 fail on import with a `VersionError` or `ImportError`.
- **Step 2: Run standalone task on R8-enabled build** : For the module and variant you found during path selection, run `./gradlew :<module>:analyze<Variant>R8Config` (for example, `./gradlew :app:analyzeReleaseR8Config`). It generates the report in `<module>/build/reports/r8/` (for example, `app/build/reports/r8/r8-config-analyzer-release.pb`). You must wait for this command to finish before proceeding.
- **Step 3: Convert to JSON** : You must explicitly run the conversion script [`scripts/convert_pb_to_json.py`](scripts/convert_pb_to_json.py) as `python3 <skill_dir>/scripts/convert_pb_to_json.py` with arguments `<module>/build/reports/r8` and `tmp/keepradius/keepruleradius.json`. Wait for this command to finish.
- **Step 4: Analyze** : You must explicitly run the analysis script [`scripts/analyze.py`](scripts/analyze.py) by executing `python3 <skill_dir>/scripts/analyze.py tmp/keepradius/keepruleradius.json`. This outputs `tmp/keepradius/analysis_result.txt`. Wait for this command to finish.

### Path B: Invoke R8 release build (AGP \< 9.3.0)

- **Step 1: Check requirements** : Python and the `protobuf` package 6.33.4 or later are mandatory: `pip install "protobuf>=6.33.4"`.
- **Step 2: Generate and analyze** : You must run the shell commands described in [references/FULL_BUILD_CONFIG_ANALYZER.md](references/FULL_BUILD_CONFIG_ANALYZER.md) to temporarily update the R8 version in `settings.gradle(.kts)` to 9.4.34 or later (so R8 generates the report), generate the proto report in `tmp/r8analysis/`, convert it to `tmp/r8analysis/keepruleradius.json`, analyze the result, and revert the temporary `settings.gradle(.kts)` change.
- **Step 3: Analyze** : Verify that the analysis outputs `tmp/r8analysis/analysis_result.txt` for scores and rule impact metrics.

## Step 3. Report generation

- **Format** : Follow [references/REPORT_FORMAT.md](references/REPORT_FORMAT.md) strictly.
- **Redundant rules** : Check keep rules against [references/INSPECT-RULES.md](references/INSPECT-RULES.md). If a keep rule matches a pattern in [references/INSPECT-RULES.md](references/INSPECT-RULES.md), include the guidance and remediation from that reference alongside the impact metrics.
- **Input** : Extract metrics (Scores, Impacts, Example Classes, rule origins) directly from the generated file `tmp/keepradius/analysis_result.txt` if using Path A, or `tmp/r8analysis/analysis_result.txt` if using Path B.
- **Output** : Short progress updates are fine while Gradle runs; the final message is the report only. Output only the raw Markdown report in the chat. Do not output conversational filler (for example, "Here is your report..."). Do not provide recommendations, next steps, or any other text outside of the sections defined in [references/REPORT_FORMAT.md](references/REPORT_FORMAT.md). Do not mention the path used for analysis of the configuration.

## Constraints

- **Strict output limit**: The final output must strictly be the Markdown report and nothing else.
- **No code changes** : Research and suggest only; do not modify project files. Create files only under `tmp/` (analysis output, the settings backup, and any scratch scripts), and never write the report to a file. The one exception is the temporary R8 `classpath` in `settings.gradle(.kts)` that Path B needs when the project doesn't already pin R8 9.4.34 or later: ask the user first when running interactively, and revert it after the analysis (see [references/FULL_BUILD_CONFIG_ANALYZER.md](references/FULL_BUILD_CONFIG_ANALYZER.md)). If that change is needed but the user says no, or asks you not to edit build files, report rule-level and 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit ba2d4bc

Download folder ↗
git clone https://github.com/android/skills
git -C skills checkout ba2d4bc1b905

The author documents no install command, so this uses the repository directly. Our verdict covers commit ba2d4bc1b905 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source ba2d4bc1b905

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/android/r8-analyzer/badge.svg)](https://modelsatlas.com/skills/android/r8-analyzer/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/android/r8-analyzer/badge.svg)](https://modelsatlas.com/skills/android/r8-analyzer/)

Questions about r8-analyzer

Is r8-analyzer safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can r8-analyzer access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (ba2d4bc1b905), read on 2026-10-31. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.