Skip to content

Safety

Safety is a property of the code.

Four enforcement layers stand between an LLM and your phone. None of them are promises — each is checked at runtime.

Layer 01

Skill allowlists

Every bundled skill declares the set of tools it may call. If a tool is not in the active skill's allowed_tools list, the agent loop rejects the call with a POLICY_BLOCKED event before it is executed.

Layer 02

Tool risk levels

LOW tools (observation, wait, foreground-app detection) run without prompting. MEDIUM tools (open_app, tap, type_text, scroll, swipe) prompt for approval on first use per session. HIGH tools always prompt.

Layer 03

Central policy decisions

A small ActionPolicy module evaluates every tool call and returns Allow, RequireApproval, or Deny. Decisions factor in the tool's risk, the active skill, the target app, and a list of app-aware rules.

Layer 04

Argument redaction

Sensitive argument values are scrubbed before they are written to logs or shown in approval copy. The redactor covers common PII patterns and named keys (password, secret, token, api_key, private_key, credential, auth, otp, pin).

What TouchPilot requests from your device

Permission Why
BIND_ACCESSIBILITY_SERVICE The agent's primary observation and control surface.
FOREGROUND_SERVICE Posts a persistent notification while the agent is running.
POST_NOTIFICATIONS Required on Android 13+ to surface the foreground service notification.
INTERNET Optional. Only used if you configure an OpenAI-compatible cloud fallback.
QUERY_ALL_PACKAGES Lets open_app resolve a friendly app name to a package without typing the package id.

What TouchPilot does not request

No message interception. No contact scraping. No file access outside its own sandbox. No microphone or camera. No call log. No overlay drawing.

Report a safety issue

Found a bypass — a missing redaction, a missing approval prompt, a privilege escalation? Please report it privately to the maintainers rather than opening a public issue.

File a private advisory →