Security
The model never gets a shell.
One file shells out to adb. It exposes a fixed set of named, validated operations, and its tests are written as the injection cases it is expected to reject.
Boundary
No shell access, by construction
One module shells out to adb. It exposes named, validated operations — there is no generic command tool for the model to reach for.
Validation
Package names are checked twice
Regex-validated, then checked against an allowlist. Injection cases are enumerated in that module's own unit tests.
Bounds
Coordinates are clamped
Every tap and swipe is clamped to the device's real screen bounds, so an out-of-range guess cannot become an off-screen action.
Keys
Navigation from a closed enum
Back, home and recents are constants. The model cannot synthesise arbitrary key events.
Scope
VISIONAGENT_ALLOWED_PACKAGES
Set the allowlist per environment. Whatever you pass to --app is added for that run only, and nothing persists between runs.
Data
Your key, your traces
Inference is billed to your Gemini key. Traces and screenshots are written to your filesystem, under runs/.