testing-tracks
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation includes examples of network operations using
curlto interact with official APIs from well-known services such as BrowserStack (api-cloud.browserstack.com), Sauce Labs (api.us-west-1.saucelabs.com), and Apple App Store Connect (api.appstoreconnect.apple.com). These references target established service providers for their intended technical purposes. - [COMMAND_EXECUTION]: The reference files contain various command-line examples including
curlfor API uploads,jqfor JSON processing,npxfor executing thewdiotesting framework, andgcloudfor Firebase Test Lab. These examples are standard developer tools used for app distribution and testing workflows. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by instructing the agent on how to ingest and process data from external, untrusted sources such as tester feedback and automated Pre-Launch Reports.
- Ingestion points: Feedback collection sections in
SKILL.mdand automated report review processes inreferences/google-play-tracks.md. - Boundary markers: None are specified in the instructions to help the agent distinguish between instructional context and external data content.
- Capability inventory: The skill documents capabilities for command-line execution (curl, npx, gcloud) across various reference files.
- Sanitization: No sanitization or validation steps are provided for handling the content of tester feedback or external report data.
Audit Metadata