gplay-cli-usage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent on how to execute
gplayCLI commands to interact with the Google Play Console, including app management, releases, and reporting. - [EXTERNAL_DOWNLOADS]: The documentation includes the
gplay updatecommand, which is a standard utility for the CLI to fetch and install its own updates from its official sources. - [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to fetch external data from the Google Play API, which introduces an attack surface where data from the Google Play Console could contain instructions that influence the agent.
- Ingestion points: Commands such as
gplay tracks list,gplay apps list, andgplay reportsingest external data from Google Play Console APIs into the agent's context. - Boundary markers: No explicit boundary markers or instructions to ignore embedded content are defined in the skill documentation.
- Capability inventory: The skill allows the agent to execute the
gplaybinary, write to the local filesystem (e.g., reports, sync metadata), and perform network operations via the API. - Sanitization: The documentation does not specify any sanitization or validation steps for the data returned from the API commands.
Audit Metadata