aso-appstore-screenshots
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates several local Python scripts including
compose.py,finalize.py, andshowcase.pyfor image compositing and processing. It also executes a bash-based CLI tool namedpixeltamerto perform AI-driven image enhancement. These executions are integral to the skill's stated purpose of generating marketing assets. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
Pillowlibrary via pip and the@houtini/gemini-mcppackage via npm. It also relies on thepixeltamertool, which is a resource provided by the vendor (gabelul) and hosted on GitHub. - [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Benefit Discovery' phase that reads and analyzes the application's codebase, including UI files, models, and metadata. This functionality creates an indirect prompt injection surface where contents of the codebase could influence the agent's logic or the instructions passed to image generation backends.
- Ingestion points: The skill analyzes UI files, view controllers, and project metadata in the
Benefit Discoveryphase withinSKILL.md. - Boundary markers: No explicit delimiters or instructions are used to separate the analyzed codebase content from the agent's internal reasoning.
- Capability inventory: The skill has the capability to execute shell commands, run localized Python scripts, and interact with external image models via specialized backends.
- Sanitization: No specific sanitization or filtering is performed on data extracted from the codebase before it is used to generate marketing headlines or enhancement prompts.
Audit Metadata