aso
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web by fetching App Store and Google Play listing pages via WebFetch (SKILL.md). While this content could theoretically contain prompt injection payloads, the skill's capabilities are limited to report generation and analysis, posing minimal risk. Boundary markers are partially implemented through the structured phased approach (Phase 1-4).
- [SAFE]: The skill uses WebFetch to retrieve data from trusted app store domains (apps.apple.com and play.google.com). This is the primary intended purpose of the skill and does not involve data exfiltration or unauthorized access.
- [SAFE]: The skill mentions checking for project-specific context in local markdown files (e.g., .agents/product-marketing.md), which is a standard practice for agent personalization and does not constitute a privacy violation.
Audit Metadata