testing-tracks

Pass

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation includes examples of network operations using curl to interact with official APIs from well-known services such as BrowserStack (api-cloud.browserstack.com), Sauce Labs (api.us-west-1.saucelabs.com), and Apple App Store Connect (api.appstoreconnect.apple.com). These references target established service providers for their intended technical purposes.
  • [COMMAND_EXECUTION]: The reference files contain various command-line examples including curl for API uploads, jq for JSON processing, npx for executing the wdio testing framework, and gcloud for Firebase Test Lab. These examples are standard developer tools used for app distribution and testing workflows.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by instructing the agent on how to ingest and process data from external, untrusted sources such as tester feedback and automated Pre-Launch Reports.
  • Ingestion points: Feedback collection sections in SKILL.md and automated report review processes in references/google-play-tracks.md.
  • Boundary markers: None are specified in the instructions to help the agent distinguish between instructional context and external data content.
  • Capability inventory: The skill documents capabilities for command-line execution (curl, npx, gcloud) across various reference files.
  • Sanitization: No sanitization or validation steps are provided for handling the content of tester feedback or external report data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 17, 2026, 12:16 AM