app-store-screens
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches application metadata, icons, and screenshots from public App Store listings (apps.apple.com) and captures content from specified websites to facilitate the design process.
- [COMMAND_EXECUTION]: The skill dynamically assembles HTML and CSS templates based on user-provided brand specifications. These templates are then rendered into PNG images via a remote server-side process where JavaScript is explicitly disabled as a security precaution.
- [DATA_EXFILTRATION]: Local product screenshots and brand fonts are uploaded to the vendor's CDN (cdn.pika.art) using the mcp__pika__upload_asset tool. This is a functional requirement to make these assets accessible to the remote rendering engine used by the skill.
- [PROMPT_INJECTION]: The skill processes untrusted input from brand documents and external website captures. While this provides a surface for indirect prompt injection, the skill's instructions focus on stylistic extraction and copywriting within a highly structured design domain, which limits the potential for malicious instruction following.
Audit Metadata