metadata-optimizer

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources which could potentially contain malicious instructions. \n- Ingestion points: App metadata files (name.txt, subtitle.txt, keywords.txt) are downloaded from App Store Connect via Fastlane in Step 1. \n- Boundary markers: The instructions do not define delimiters or specific 'ignore' prompts when reading these files. \n- Capability inventory: The skill uses fastlane and aso CLI tools and has file-write access to the metadata directory. \n- Sanitization: The skill does not explicitly sanitize the text downloaded from the app store before processing.
  • [COMMAND_EXECUTION]: The skill uses command-line tools to interact with external services and analyze data. \n- Evidence: Execution of fastlane deliver download_metadata, aso keywords analyze, aso keywords recommend, and fastlane deliver. \n- Context: These commands are core to the skill's functionality and trace back to expected vendor/standard tooling. External data from Step 1 is passed as arguments to the aso analyze command.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 09:04 AM