aso
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is to analyze public app store listings. It utilizes web search and fetching capabilities to retrieve metadata (titles, descriptions, categories) from official domains (apps.apple.com and play.google.com).
- [SAFE]: Analysis of all seven files, including reference guides and scoring criteria, revealed no evidence of obfuscation, hardcoded credentials, or attempts at privilege escalation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external app listing pages. While this is necessary for its core purpose, it establishes an attack surface for indirect prompt injection if a listing description contains malicious instructions.
- Ingestion points: App Store and Google Play listing pages retrieved via WebFetch in
SKILL.md. - Boundary markers: Absent; the instructions do not explicitly define delimiters for untrusted content or warn the agent to ignore embedded instructions in the fetched data.
- Capability inventory: The agent performs text analysis and generates reports based on
references/report-template.md; it does not have the capability to execute code or write to the filesystem based on the fetched data. - Sanitization: No explicit sanitization or filtering of the fetched HTML/text content is performed prior to analysis.
Audit Metadata