apple-app-store-reviews
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
scripts/get_apple_reviews.sh) to perform network requests and data processing. The script correctly usesset -euo pipefailfor error handling. - [EXTERNAL_DOWNLOADS]: The skill makes a network request to
ai-factory.frevana.comto fetch app reviews. This is the primary function of the skill and uses a vendor-specific domain consistent with the skill's purpose. - [CREDENTIALS_UNSAFE]: The skill manages a
FREVANA_TOKENfor authentication. The script is designed to read this from the environment or a command-line flag and explicitly instructs the agent not to echo the token back to the user. - [DATA_EXFILTRATION]: While the skill communicates with an external API, it only sends user-provided product IDs and pagination parameters. No sensitive local data (like SSH keys or AWS credentials) is accessed or transmitted.
- [DYNAMIC_EXECUTION]: The script uses
python3to safely handle JSON serialization and validation. The Python code is passed via stdin (heredoc), which is a standard pattern for small utility tasks in shell scripts and does not involve executing untrusted user input as code.
Audit Metadata