google-play-store-api
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests the installation of the 'scavio' SDK via standard package registries (pip and npm). These packages are the official libraries provided by the vendor for interacting with their API.- [COMMAND_EXECUTION]: Includes basic shell commands for environment variable setup and package installation, which are routine for skill configuration.- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external content from the Google Play Store (descriptions, reviews), which represents an untrusted data surface.
- Ingestion points: Untrusted data enters the agent context through responses from the '/search', '/app', and '/reviews' endpoints (SKILL.md).
- Boundary markers: The provided implementation examples do not use specific delimiters or instructions to isolate the retrieved external data.
- Capability inventory: The skill performs network operations to the vendor's API.
- Sanitization: No explicit sanitization or validation of the retrieved store content is demonstrated in the examples.
Audit Metadata