Agent skill · Audited from source
r8-analyzer
skill · android/skillsApache-2.0 licenceAudited 31 Oct 2026 · source ba2d4bc1b905
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit ba2d4bc1b905 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Analyzes Android build files and R8 keep rules to identify redundancies,
Cite
Cite this page
ModelsAtlas. “r8-analyzer (android/skills)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/android/r8-analyzer
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha ba2d4bc1b905 · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherandroid GitHub organizationOwner of the repository this skill is read from
- Source folderandroid/skills/performance/r8-analyzerThe exact folder we audited
- LicenceApache-2.0As the repository states it
- Commit pinned for this verdictba2d4bc1b905A new audit runs when the source changes
- Repository statusNot archivedLast push 1 day ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Analyzes Android build files and R8 keep rules to identify redundancies,
---
name: r8-analyzer
description: Analyzes Android build files and R8 keep rules to identify redundancies,
broad package-wide rules, and rules that subsume library consumer keep rules. Use
this skill when developers want to optimize their Android app's size, remove redundant
or overly broad keep rules, or troubleshoot ProGuard configurations. Don't use for
general Gradle build errors, Compose UI performance, or runtime CPU profiling.
license: Complete terms in LICENSE.txt
metadata:
author: Google LLC
last-updated: '2026-10-24'
keywords:
- R8
- proguard
- keep rules
- app size
- optimization
- shrinking
- minification
- obfuscation
---
## Step 1. Setup and configuration check
- Inspect `build.gradle`, `build.gradle.kts`, and `gradle.properties`.
- Use [references/CONFIGURATION.md](references/CONFIGURATION.md) to identify missing optimizations.
- **AGP** : If the version is lower than 9.3, suggest migration to 9.3 for the simplified [`optimization {}` DSL](references/android/topic/performance/app-optimization/enable-app-optimization.md) and the Configuration Analyzer task.
- **Full mode** : Verify `android.enableR8.fullMode=false` is removed from the `gradle.properties` file.
## Step 2. Analysis path selection
- Inspect `build.gradle`, `build.gradle.kts`, `settings.gradle`, `settings.gradle.kts`, `gradle.properties`, and `libs.versions.toml` to get the AGP and R8 versions. An R8 version pinned in `settings.gradle(.kts)` replaces the R8 bundled with AGP.
- Find the app module (usually `app`) and a build variant with R8 enabled (usually `release`). The following commands use them as `<module>` and `<Variant>`, for example `:app:minifyReleaseWithR8`.
- The helper scripts are in this skill's `scripts/` directory. In the following
commands, `<skill_dir>` is this skill's directory. Run every command from the
project root.
- **If AGP \>= 9.3.0** : Proceed to **Path A (Standalone Task)**.
- **If AGP \< 9.3.0** : Proceed to **Path B (Quantitative)**.
### Path A: Standalone Gradle task (AGP \>= 9.3.0)
- **Step 1: Check requirements** : Python and the `protobuf` package 6.33.4 or later are mandatory (used by [`scripts/keep_radius_pb2.py`](scripts/keep_radius_pb2.py)). Install it with `pip install "protobuf>=6.33.4"`; versions lower than 6.33.4 fail on import with a `VersionError` or `ImportError`.
- **Step 2: Run standalone task on R8-enabled build** : For the module and variant you found during path selection, run `./gradlew :<module>:analyze<Variant>R8Config` (for example, `./gradlew :app:analyzeReleaseR8Config`). It generates the report in `<module>/build/reports/r8/` (for example, `app/build/reports/r8/r8-config-analyzer-release.pb`). You must wait for this command to finish before proceeding.
- **Step 3: Convert to JSON** : You must explicitly run the conversion script [`scripts/convert_pb_to_json.py`](scripts/convert_pb_to_json.py) as `python3 <skill_dir>/scripts/convert_pb_to_json.py` with arguments `<module>/build/reports/r8` and `tmp/keepradius/keepruleradius.json`. Wait for this command to finish.
- **Step 4: Analyze** : You must explicitly run the analysis script [`scripts/analyze.py`](scripts/analyze.py) by executing `python3 <skill_dir>/scripts/analyze.py tmp/keepradius/keepruleradius.json`. This outputs `tmp/keepradius/analysis_result.txt`. Wait for this command to finish.
### Path B: Invoke R8 release build (AGP \< 9.3.0)
- **Step 1: Check requirements** : Python and the `protobuf` package 6.33.4 or later are mandatory: `pip install "protobuf>=6.33.4"`.
- **Step 2: Generate and analyze** : You must run the shell commands described in [references/FULL_BUILD_CONFIG_ANALYZER.md](references/FULL_BUILD_CONFIG_ANALYZER.md) to temporarily update the R8 version in `settings.gradle(.kts)` to 9.4.34 or later (so R8 generates the report), generate the proto report in `tmp/r8analysis/`, convert it to `tmp/r8analysis/keepruleradius.json`, analyze the result, and revert the temporary `settings.gradle(.kts)` change.
- **Step 3: Analyze** : Verify that the analysis outputs `tmp/r8analysis/analysis_result.txt` for scores and rule impact metrics.
## Step 3. Report generation
- **Format** : Follow [references/REPORT_FORMAT.md](references/REPORT_FORMAT.md) strictly.
- **Redundant rules** : Check keep rules against [references/INSPECT-RULES.md](references/INSPECT-RULES.md). If a keep rule matches a pattern in [references/INSPECT-RULES.md](references/INSPECT-RULES.md), include the guidance and remediation from that reference alongside the impact metrics.
- **Input** : Extract metrics (Scores, Impacts, Example Classes, rule origins) directly from the generated file `tmp/keepradius/analysis_result.txt` if using Path A, or `tmp/r8analysis/analysis_result.txt` if using Path B.
- **Output** : Short progress updates are fine while Gradle runs; the final message is the report only. Output only the raw Markdown report in the chat. Do not output conversational filler (for example, "Here is your report..."). Do not provide recommendations, next steps, or any other text outside of the sections defined in [references/REPORT_FORMAT.md](references/REPORT_FORMAT.md). Do not mention the path used for analysis of the configuration.
## Constraints
- **Strict output limit**: The final output must strictly be the Markdown report and nothing else.
- **No code changes** : Research and suggest only; do not modify project files. Create files only under `tmp/` (analysis output, the settings backup, and any scratch scripts), and never write the report to a file. The one exception is the temporary R8 `classpath` in `settings.gradle(.kts)` that Path B needs when the project doesn't already pin R8 9.4.34 or later: ask the user first when running interactively, and revert it after the analysis (see [references/FULL_BUILD_CONFIG_ANALYZER.md](references/FULL_BUILD_CONFIG_ANALYZER.md)). If that change is needed but the user says no, or asks you not to edit build files, report rule-level and Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit ba2d4bc
git clone https://github.com/android/skills git -C skills checkout ba2d4bc1b905
The author documents no install command, so this uses the repository directly. Our verdict covers commit ba2d4bc1b905 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
ba2d4bc1b905
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/android/r8-analyzer/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when creating new skills, editing existing skills, or verifying skills work before deployment
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
obra/superpowers
Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
obra/superpowers
Use when implementing any feature or bugfix, before writing implementation code
Add this badge to your README
[](https://modelsatlas.com/skills/android/r8-analyzer/)
<a href="https://modelsatlas.com/skills/android/r8-analyzer/"><img src="https://modelsatlas.com/skills/android/r8-analyzer/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about r8-analyzer
Is r8-analyzer safe to install?
What can r8-analyzer access on my machine?
How current is this page?
Sources
- github.com/android/skills/tree/main/performance/r8-analyzer — the audited source at commit ba2d4bc1b905 and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- Is r8-analyzer safe to install?
- What can r8-analyzer access on my machine?
- How current is this page?