gps-accounts
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions involve referencing and configuring Google Play Service Account JSON keys stored in sensitive file paths (e.g., /secrets/phosum-sa.json). While central to the skill purpose, it represents a data exposure risk.
- [COMMAND_EXECUTION]: The skill relies on the execution of the gps CLI tool to perform registration and management tasks.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing external application names and package IDs.
- Ingestion points: Data from gps apps add and the local configuration file ~/.config/gps/config.json (SKILL.md).
- Boundary markers: None identified in the instructions.
- Capability inventory: Shell command execution via gps for track and review management (SKILL.md).
- Sanitization: No validation or sanitization of ingested application metadata was identified.
Audit Metadata