The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the google-play-scraper package from PyPI, which is a standard and well-known package registry for Python dependencies.
[DATA_EXFILTRATION]: The skill performs network requests to Google Play Store endpoints to retrieve public application metadata and reviews. These operations target Google, a well-known service provider, and are essential to the skill's primary function.
[PROMPT_INJECTION]: The skill processes untrusted user-generated content in the form of Play Store reviews. This ingestion of external data presents a surface for indirect prompt injection.
Ingestion points: Data is fetched from external Play Store endpoints via the google-play-scraper library in scripts/listing.py.
Boundary markers: The script provides structure by outputting data in JSON format or as labeled text, helping to delineate external content from agent instructions.
Capability inventory: The skill's capabilities are limited to network access for scraping; it does not possess file-write or shell-execution privileges.
Sanitization: While the script shapes and truncates the data for display, it does not perform specific sanitization of the review text to neutralize potential prompt injection attempts.
Mitigation: To reduce risk, the agent should treat fetched review text as untrusted content and use strict delimiters when processing it in downstream tasks.

play-store-listing