app-launch
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidance and checklists for mobile app launch strategies. It operates as a high-level advisor without executing dangerous system commands or establishing unauthorized network connections.- [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface related to untrusted data ingestion, though no malicious implementation is present.
- Ingestion points: The skill is instructed to read
app-marketing-context.mdfor app-specific context in the 'Initial Assessment' section. - Boundary markers: Absent; there are no specific delimiters or instructions to ignore embedded commands within the external context file.
- Capability inventory: The skill itself does not contain subprocess calls, network operations, or file-writing logic; however, it references and likely triggers sibling skills (e.g.,
ua-campaign,app-analytics) which may have such capabilities. - Sanitization: Absent; the content of the marketing context file is treated as authoritative without validation.
- Conclusion: This is a standard architectural pattern for AI agent skills to acquire context and is considered safe under normal usage conditions.
Audit Metadata