android-playstore-setup
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local Android project files to generate documentation and configuration checklists.
- Ingestion points: Step 1 and Step 2 of
SKILL.mddescribe scanningAndroidManifest.xmlandbuild.gradleto extract app identity and permission information. - Boundary markers: The skill does not define specific delimiters to separate extracted file content from instructions, potentially allowing malformed project files to influence agent behavior.
- Capability inventory: Extracted data is used to populate
PLAY_CONSOLE_SETUP.mdanddocs/privacy-policy.md, and to configure version management scripts. - Sanitization: No explicit sanitization or validation logic is specified for the data parsed from the XML or Gradle files before it is interpolated into generated templates.
- [EXTERNAL_DOWNLOADS]: The skill utilizes official libraries from well-known registries to perform API connectivity and permission validation.
- Evidence:
SKILL.mdStep 11 instructs the user to installgoogle-authandgoogle-api-python-clientvia pip to support thevalidate-playstore.pyscript. - [DYNAMIC_EXECUTION]: The skill generates and executes shell and Python scripts based on project metadata.
- Evidence: The skill creates several functional scripts including
scripts/version-manager.shandscripts/validate-playstore.py. This is consistent with the primary purpose of the skill to automate deployment workflows.
Audit Metadata