gpd-submission-health
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
gpdCLI tool to perform various release management tasks on the Google Play Store. - Commands are used to validate edits, check release status, fetch listing metadata, and upload assets (e.g.,
gpd publish status,gpd publish listing get,gpd publish release). - [INDIRECT_PROMPT_INJECTION]: The skill fetches data from external sources (Google Play Store), which could theoretically contain malicious instructions if the store metadata is compromised.
- Ingestion points: The skill fetches external metadata using
gpd publish status,gpd publish listing get, andgpd publish details getin SKILL.md. - Boundary markers: There are no explicit delimiters or instructions telling the agent to ignore potentially malicious content within the fetched metadata.
- Capability inventory: The skill possesses the capability to modify store content and trigger production releases using
gpd publish release(SKILL.md). - Sanitization: No evidence of sanitization or validation of the fetched metadata is present before processing.
Audit Metadata