launch-asset-packager
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust security posture by explicitly instructing the agent to treat all user-provided asset lists, store exports, and press-kit drafts as untrusted input. It references a
SECURITY.mdfile for handling these inputs. - [SAFE]: Data operations are restricted to structured proposals via a dedicated script (
registry-events.py) rather than direct file modification, following a least-privilege approach to state management. - [SAFE]: The skill defines clear scope boundaries, delegating high-privilege technical tasks (like SEO execution or site changes) to other specific skills rather than attempting to execute them directly.
- [SAFE]: External references are limited to official documentation (App Store Connect, Play Console) and trusted industry standards (presskit() convention), avoiding reliance on third-party tools or unknown remote scripts.
- [SAFE]: No obfuscation, prompt injection attempts, or persistence mechanisms were found. The use of dynamic data sources (
~~app store data,~~web analytics) follows the platform's established connector patterns for local data access.
Audit Metadata