apps-script-marketplace-publish
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/fetch-review-requirements.pyretrieves content from Google's official documentation athttps://developers.google.com/workspace/marketplace/about-app-review. This is an official resource from a well-known service.\n- [COMMAND_EXECUTION]: The skill usessubprocess.runto call thecurlbinary for network fetching. The call uses a fixed list of arguments and a hardcoded URL, avoiding shell injection risks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a remote URL to generate an audit checklist. \n - Ingestion points: External data is ingested from the Google Developers portal via
scripts/fetch-review-requirements.py. \n - Boundary markers: The output displays the source URL but does not use specific delimiters for the ingested text. \n
- Capability inventory: The skill accesses local project files for auditing and performs network requests. \n
- Sanitization: The script uses regular expressions to extract requirement text from HTML tags, filtering out most metadata and page structure.
Audit Metadata