@condret If I'm concerned with malware, I just don't install and run it.

Reverse engineering is incredibly time consuming and I reckon google would send a death squad to get you if you find the malware in the SDK and proved it in a way they couldn't refute.