android-tombstone-symbolication — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited android-tombstone-symbolication (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 7 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Resolves native backtrace frames from .NET Android app crashes (MAUI, Xamarin, Mono) to function names, source files, and line numbers using ELF BuildIds and Microsoft's symbol server.
Inputs: Tombstone file or logcat crash output, llvm-symbolizer (from Android NDK or any LLVM 14+ toolchain), internet access for symbol downloads.
Do not use when: The crash is a managed .NET exception (visible in logcat with a managed stack trace), the crashing library is not a .NET component (e.g., libart.so), or the tombstone is from iOS.
Each backtrace frame has this format:
#NN pc OFFSET /path/to/library.so (optional_symbol+0xNN) (BuildId: HEXSTRING)Extract: frame number, PC offset (hex, already library-relative), library name, and BuildId (32–40 hex chars).
Symbolicate all threads by default (background threads like GC/finalizer often have useful .NET frames). The crashing thread's backtrace is listed first; additional threads appear after --- --- --- markers.
Format notes:
#NN pc frame lines with or without a backtrace: header, and strips logcat timestamp/tag prefixes automatically.adb shell readelf -n, CI build artifacts, or the .NET runtime NuGet package.#1 pc into issue links — replace org/repo#N pc with #N pc before saving to a file.#NN pc OFFSET library.so (BuildId: HEX) tuples.Filter frames to .NET runtime libraries:
| Library | Runtime |
|---|---|
libmonosgen-2.0.so | Mono (MAUI, Xamarin, interpreter) |
libcoreclr.so | CoreCLR (JIT mode) |
libSystem.*.so | .NET BCL native components (Native, Globalization.Native, IO.Compression.Native, Security.Cryptography.Native.OpenSsl, Net.Security.Native) |
NativeAOT: No libcoreclr.so or libmonosgen-2.0.so — the runtime is statically linked into the app binary (e.g., libMyApp.so). The libSystem.*.so BCL libraries remain separate and can be symbolicated via the symbol server. For the app binary itself, you need the app's own debug symbols.
Skip libc.so, libart.so, and other Android system libraries unless the user specifically asks.
For each unique .NET BuildId, download debug symbols:
https://msdl.microsoft.com/download/symbols/_.debug/elf-buildid-sym-<BUILDID>/_.debugcurl -sL "https://msdl.microsoft.com/download/symbols/_.debug/elf-buildid-sym-1eb39fc72918c7c6c0c610b79eb3d3d47b2f81be/_.debug" \
-o libmonosgen-2.0.so.debugVerify with file libmonosgen-2.0.so.debug — should show ELF 64-bit ... with debug_info, not stripped. If the download returns 404 or HTML, symbols are not published for that build. Do not add or subtract library base addresses — offsets in tombstones are already library-relative.
llvm-symbolizer --obj=libmonosgen-2.0.so.debug -f -C 0x222098Output:
ves_icall_System_Environment_FailFast
/__w/1/s/src/runtime/src/mono/mono/metadata/icall.c:6244The /__w/1/s/ prefix is the CI workspace root — the meaningful path starts at src/runtime/, mapping to dotnet/dotnet VMR.
Combine original frame numbers with resolved function names and source locations:
#00 libc.so abort+164
#01 libmonosgen-2.0.so ves_icall_System_Environment_FailFast (mono/metadata/icall.c:6244)
#02 libmonosgen-2.0.so do_icall (mono/mini/interp.c:2457)
#03 libmonosgen-2.0.so mono_interp_exec_method (mono/mini/interp.c)For unresolved frames (??), keep the original line with BuildId and PC offset.
scripts/Symbolicate-Tombstone.ps1 automates the full workflow:
pwsh scripts/Symbolicate-Tombstone.ps1 -TombstoneFile tombstone_01.txt -LlvmSymbolizer llvm-symbolizerFlags: -CrashingThreadOnly (limit to crashing thread), -OutputFile path (write to file), -ParseOnly (report libraries/BuildIds/URLs without downloading), -SkipVersionLookup (skip runtime version identification).
Check the Android NDK first: $ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/*/bin/llvm-symbolizer or $ANDROID_HOME/ndk/*/toolchains/llvm/prebuilt/*/bin/llvm-symbolizer. Also available via brew install llvm, apt install llvm, or xcrun --find llvm-symbolizer on macOS.
If unavailable, complete steps 1–3 and present the download commands and llvm-symbolizer commands for the user to run. Do not spend time installing LLVM.
CI source paths use these prefixes:
| Path prefix | Maps to |
|---|---|
/__w/1/s/src/runtime/ | src/runtime/ in dotnet/dotnet VMR |
/__w/1/s/src/mono/ | src/mono/ in the VMR (older builds) |
/__w/1/s/ | VMR root |
The script identifies the exact .NET runtime version by matching BuildIds against locally-installed runtime packs. It searches: SDK packs ($DOTNET_ROOT/packs/), NuGet cache (~/.nuget/packages/), and NuGet.org as an online fallback. When found, it extracts the version and source commit from the .nuspec <repository commit="..." /> element. Pass -SkipVersionLookup to disable. Requires llvm-readelf (auto-discovered from the NDK).
file <debug-file> shows ELF ... with debug_info, not stripped??)mono/metadata/, mono/mini/)-ParseOnly, present manual commands. Do not install LLVM.adb shell readelf -n /path/to/lib.so, CI build artifacts, or the runtime NuGet package (~/.dotnet/packs/Microsoft.NETCore.App.Runtime.Mono.android-arm64/<version>/). Prefer pulling raw tombstone files (adb shell cat /data/tombstones/tombstone_XX) which always include BuildIds..so/.so.dbg in build artifacts or the NuGet runtime pack..so in the tombstone — runtime is in the app binary. libSystem.*.so BCL libraries still work with the symbol server; the app binary needs its own debug symbols.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.