aso
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches app listing data from official domains (apps.apple.com and play.google.com) to perform audits. These are well-known services.
- [DATA_EXPOSURE]: Accesses local configuration files, such as
.agents/product-marketing.md, to provide context-aware analysis. This is standard behavior for personalized agent skills. - [PROMPT_INJECTION]: Ingests untrusted content from external app store listings (descriptions, reviews), which presents an indirect prompt injection surface.
- Ingestion points: External listing pages retrieved via WebFetch in SKILL.md.
- Boundary markers: Not explicitly defined for the ingested text.
- Capability inventory: The skill uses WebFetch and browser-based screenshot capabilities.
- Sanitization: No specific sanitization or filtering of fetched text is performed before analysis.
Audit Metadata