metadata-optimizer
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources which could potentially contain malicious instructions. \n- Ingestion points: App metadata files (name.txt, subtitle.txt, keywords.txt) are downloaded from App Store Connect via Fastlane in Step 1. \n- Boundary markers: The instructions do not define delimiters or specific 'ignore' prompts when reading these files. \n- Capability inventory: The skill uses
fastlaneandasoCLI tools and has file-write access to the metadata directory. \n- Sanitization: The skill does not explicitly sanitize the text downloaded from the app store before processing. - [COMMAND_EXECUTION]: The skill uses command-line tools to interact with external services and analyze data. \n- Evidence: Execution of
fastlane deliver download_metadata,aso keywords analyze,aso keywords recommend, andfastlane deliver. \n- Context: These commands are core to the skill's functionality and trace back to expected vendor/standard tooling. External data from Step 1 is passed as arguments to theaso analyzecommand.
Audit Metadata