gps-ops
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
gpsCLI tool to interact with the Google Play Store API. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by providing tools to read user-generated content (app reviews).
- Ingestion points:
SKILL.md(via thegps_list_reviewsandgps_search_reviewcommands). - Boundary markers: None specified in the provided instructions.
- Capability inventory: Local command execution via the
gpsCLI. - Sanitization: Not explicitly addressed.
- [SAFE]: No high-severity security concerns such as base64 obfuscation, remote code execution from untrusted sources, or data exfiltration to unknown domains were found. The skill includes standard safety practices, such as requiring a confirmation flag for write operations.
Audit Metadata