nomen
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches app metadata and name availability from official, well-known services including Apple's iTunes Search API (
itunes.apple.com), GitHub's API, and standard package registries (npm, PyPI, Cargo, RubyGems). - [COMMAND_EXECUTION]: Uses standard developer CLI tools (
gh,npm,pip,cargo,gem,dig,curl) to perform name validation and availability checks. The commands are used according to best practices (e.g., using--data-urlencodefor API queries). - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: External data sources including GitHub repository names, package registry metadata, and App Store search results (track names and seller names).
- Boundary markers: The instructions guide the agent to perform specific case-insensitive string comparisons on fields like
trackName, providing a degree of logical isolation from the rest of the payload. - Capability inventory: The skill can execute CLI tools for information gathering and write changes to local files during project renaming tasks.
- Sanitization: No explicit sanitization of external data is defined, but the intended use is limited to name comparison and validation.
Audit Metadata