aso
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data retrieved from external URLs (App Store and Google Play listings) via WebFetch. While this is an inherent attack surface for any agent that reads web content, the risk is minimal as the skill lacks capabilities to execute commands or exfiltrate sensitive data. Analysis involves:
- Ingestion points: Listing data fetched from external URLs defined in SKILL.md Phase 1.
- Capability inventory: The skill only generates text-based reports and does not use dangerous tools like subprocess or file-write.
- Boundary markers: Not explicitly defined in instructions.
- Sanitization: Not explicitly defined.
Audit Metadata