apphouse-check
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to scan the local repository for sensitive information, including environment files (.env) and API keys (OpenAI, RevenueCat, Firebase), as part of a security audit to identify release blockers. Findings are saved to a local report file.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to verify that legal URLs (Privacy Policy, Terms of Service) provided in the application manifest resolve correctly.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it reads and processes untrusted application source code and configuration files during the audit.
- Ingestion points: App source code, apphouse.project.yml, project configuration files (e.g., GoogleService-Info.plist), and content from external legal URLs.
- Boundary markers: The skill does not define specific delimiters to separate untrusted audit data from instructions.
- Capability inventory: The skill uses file system read access for analysis, file system write access for report generation, and network GET requests for URL verification.
- Sanitization: No sanitization or validation of the ingested code content is specified.
Audit Metadata