gplay-cli-usage
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents an agent workflow that interacts with the Google Play Store API and local configuration, creating an indirect prompt injection surface.\n
- Ingestion points: The agent may process data from
gplay reviews list(API output) and read from repository-level configuration files such as.gplay/config.json.\n - Boundary markers: No specific delimiters or safety instructions for handling untrusted data are provided in this documentation.\n
- Capability inventory: The CLI tool is capable of performing authenticated mutations on the Google Play Store (e.g.,
gplay releases upload,gplay metadata apply) and managing local state files.\n - Sanitization: The documentation does not describe sanitization or filtering of API responses or file contents.\n- [NO_CODE]: The skill is purely informational, consisting of Markdown documentation and command-line examples. It does not include scripts, binaries, or configuration files that execute code automatically.\n- [SAFE]: The skill references official resources belonging to the author, such as the
PollyGlot/google-play-clirepository and thegplay.shdomain. These are consistent with the vendor's own ecosystem and do not present a third-party supply chain risk.
Audit Metadata