auditing-app-store-compliance
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes multiple system utilities including
grep,find,xcodebuild,codesign,security,plutil,lipo, andduto analyze local application files and build artifacts. It also uses the GitHub CLI (gh) to transmit audit findings to a remote repository.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local source code and configuration files, presenting an attack surface where malicious content within the audited files could influence the generated report or the agent's behavior.\n - Ingestion points: Processes
.swift,.plist,.yml,.xcconfig,.mobileprovision,.entitlements, and.entitlementsfiles.\n - Boundary markers: No explicit instructions are provided to the agent to delimit or ignore instructions that might be embedded within the source code comments or metadata of the files being audited.\n
- Capability inventory: The skill uses
grepandfindfor reading files and thegh(GitHub CLI) tool to create issues on remote repositories.\n - Sanitization: There is no evidence of sanitization or escaping of the content extracted from the files before it is interpolated into the GitHub issue body.
Audit Metadata