app-store-screenshots

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-supplied app screenshots and metadata retrieved from the App Store via scripts/fetch_listing.py. This content is used to influence the generated design styles and marketing copy.
  • Ingestion points: User screenshots provided during intake and app metadata fetched from the Apple App Store API.
  • Boundary markers: No explicit delimiters are used to separate untrusted external content from agent instructions during storyboard generation.
  • Capability inventory: The skill has the ability to write to the local filesystem, perform network requests to external AI APIs, and execute bundled Python and Node.js scripts.
  • Sanitization: No explicit sanitization or filtering of the processed metadata or screenshot analysis results was identified.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves configuration and assets from well-known services and trusted repositories.
  • Fetches device frames from the official fastlane/frameit-frames repository on GitHub.
  • References the Three.js library and Simple Icons set through the jsdelivr.net CDN for rendering tasks.
  • Communicates with official endpoints for OpenAI, Google Gemini, and the Apple App Store for image generation and metadata retrieval.
  • [COMMAND_EXECUTION]: The skill utilizes several internal utility scripts to perform its core functions, which is standard for high-complexity AI agent tasks.
  • scripts/fetch_listing.py: Downloads screenshots and metadata from official store listings.
  • scripts/gen_image.py: A wrapper for interacting with OpenAI and Google image generation APIs using environment-stored credentials.
  • scripts/export.js: Uses the Playwright framework to render HTML screenshot panels and export them as finalized PNG/JPEG files.
  • scripts/chroma_key.py: A Python script using standard libraries for background removal on generated assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:48 PM