gplay-user-management
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Provides instructions to execute the gplay command-line tool for managing Google Play Console users, developers, and app grants.
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON payloads via the --json flag, creating a vulnerability surface where an agent could be manipulated into granting unauthorized permissions if it populates the JSON using untrusted input from external sources.
- Ingestion points: The --json argument in gplay users create, gplay users update, gplay grants create, and gplay grants update commands in SKILL.md.
- Boundary markers: No delimiters or instructions to ignore nested commands are provided for the input data.
- Capability inventory: Ability to manage global account permissions and per-app access for any user in the developer account.
- Sanitization: The instructions do not include steps to verify or sanitize the JSON content before it is processed by the agent and passed to the CLI.
Audit Metadata