This repository contains a reusable Codex skill and helper scripts for local Android emulator UX auditing. It does not contain production credentials, app-specific data, screenshots, or private project configuration.
Auditing mobile apps can expose sensitive information in screenshots and logs. Treat every generated artifact as sensitive by default.
Do not commit or publish:
- emails, names, account identifiers, profile photos
- VINs, license plates, vehicle records, notes, receipts, purchase URLs
- API keys, tokens, keystores, Firebase files,
local.properties,.envfiles - unredacted screenshots from real user accounts
- production logs or crash dumps with personal data
The .gitignore excludes common generated and secret files, but you are still responsible for reviewing every artifact before publishing it.
If you find a security issue in this skill or its helper scripts, please open a private security advisory on GitHub if available, or contact the maintainer through GitHub.
Please include:
- affected file or script
- reproduction steps
- expected vs actual behavior
- potential impact
- suggested mitigation if known
- Redaction-first reporting.
- Local-only execution unless the audited app itself opens network flows.
- No bundled app-specific data.
- No automatic upload of screenshots or logs.
- Human review before public sharing.