gplay-apps
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent on how to use the
gplaycommand-line interface to interact with the Google Play Publisher API. It includes commands for adding/removing apps from a local registry (gplay apps add,gplay apps remove), viewing and modifying app metadata (gplay apps details set), and performing consistency audits (gplay apps audit). - [INDIRECT_PROMPT_INJECTION]: The
gplay apps auditcommand ingests external, potentially untrusted data from the Google Play Store, such as app descriptions and release notes, which could contain malicious instructions. - Ingestion points:
gplay apps auditfetches server-side data from Google Play (described inSKILL.md). - Boundary markers: The skill does not provide specific delimiters or instructions to the agent to treat this external content as untrusted data.
- Capability inventory: The skill possesses write capabilities through the
gplay apps details setcommand, which could be misused if the agent obeys instructions hidden in the audited data. - Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the Google Play API.
Audit Metadata