global-app-store-release
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from GitHub pull requests and commit messages.
- Ingestion points: Pull request titles, bodies, labels, and commit messages (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: File writing to the repository and local shell command execution via a Python script.
- Sanitization: None identified; the agent is instructed to summarize changes but not to sanitize the input strings.
- [DATA_EXFILTRATION]: The skill reads
fastlane/metadata/review_information/notes.txt, a file that commonly contains sensitive App Store reviewer credentials. While the skill includes explicit instructions not to output or create secrets, the access to this file path is a point of data exposure. - [COMMAND_EXECUTION]: The skill runs a local Python script (
validate_metadata.py) to validate the generated metadata. While the script itself is benign and part of the skill, the execution of shell commands is a capability that could be targeted if an injection occurs.
Audit Metadata