shiny-maui-hosting
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches application version information and metadata from official platform stores including the Apple App Store, Google Play Store, and Microsoft Store.- [INDIRECT_PROMPT_INJECTION]: The skill implements features that process data from external web sources, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: The IAppStore.GetCurrent() method retrieves and processes data from the iTunes Search API and scrapes HTML from the Google Play Store (SKILL.md).
- Boundary markers: There are no defined delimiters or specific instructions to ignore embedded commands within the ingested store data.
- Capability inventory: The skill interacts with system-level browser and deep-linking services via OpenBrowser, OpenMap, OpenStore, and OpenReviewPage (SKILL.md).
- Sanitization: The documentation mentions the use of GeneratedRegex for data extraction from Android HTML, but does not specify further sanitization or validation of the retrieved content before it enters the agent's context.
Audit Metadata