android-playstore-setup

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes local Android project files to generate documentation and configuration checklists.
  • Ingestion points: Step 1 and Step 2 of SKILL.md describe scanning AndroidManifest.xml and build.gradle to extract app identity and permission information.
  • Boundary markers: The skill does not define specific delimiters to separate extracted file content from instructions, potentially allowing malformed project files to influence agent behavior.
  • Capability inventory: Extracted data is used to populate PLAY_CONSOLE_SETUP.md and docs/privacy-policy.md, and to configure version management scripts.
  • Sanitization: No explicit sanitization or validation logic is specified for the data parsed from the XML or Gradle files before it is interpolated into generated templates.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes official libraries from well-known registries to perform API connectivity and permission validation.
  • Evidence: SKILL.md Step 11 instructs the user to install google-auth and google-api-python-client via pip to support the validate-playstore.py script.
  • [DYNAMIC_EXECUTION]: The skill generates and executes shell and Python scripts based on project metadata.
  • Evidence: The skill creates several functional scripts including scripts/version-manager.sh and scripts/validate-playstore.py. This is consistent with the primary purpose of the skill to automate deployment workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 11:21 AM