app-store-opportunity-research
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No attempts to override system behavior, bypass safety filters, or extract system prompts were detected in the instructions.
- [DATA_EXFILTRATION]: The skill does not access sensitive local files (e.g., .ssh, .aws, .env) or hardcoded credentials. Network operations are limited to legitimate research sites like apple.com, google.com, reddit.com, and indiehackers.com.
- [REMOTE_CODE_EXECUTION]: There are no patterns involving the download and execution of scripts (e.g., curl|bash) or the installation of unverified software.
- [COMMAND_EXECUTION]: The skill does not use shell commands or subprocess calls for malicious purposes. It primarily utilizes browser and search tools for data gathering.
- [OBFUSCATION]: All URLs and instructions are in plain text. No Base64, hex encoding, or zero-width character manipulation was found.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the web (App Store reviews, Reddit posts). While this represents a theoretical injection surface (Category 8), the skill uses this data only to generate research reports and PRDs. There are no high-privilege capabilities (like script execution or file-system modification based on this data) that would allow for exploitation. The risk is considered negligible for the intended use case.
Audit Metadata