play-store-publish
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to operate in 'AUTONOMOUS MODE' and explicitly commands it to 'Do NOT ask questions' and 'Do NOT pause for confirmation'. This attempts to override standard AI safety protocols requiring human-in-the-loop (HITL) oversight for high-impact actions like deployment and signing key management.\n- [COMMAND_EXECUTION]: The 'Self-Evolution Telemetry' section directs the agent to append execution metadata to a file at '~/.claude/projects/skill-telemetry.md'. Writing to a hidden directory in the user's home folder constitutes a persistence mechanism that tracks usage and outcomes across different projects and sessions.\n- [COMMAND_EXECUTION]: The 'Self-Healing Validation' logic requires the agent to execute shell commands such as 'terraform validate', 'docker build --check', and 'kubectl dry-run'. These commands can trigger the execution of local code or interact with external environments depending on the configuration of the files being validated.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface in Phase 7 and Phase 8, where it analyzes the project's source code and configuration files to determine data safety and content ratings.\n
- Ingestion points: The skill reads 'build.gradle', 'pubspec.yaml', and application source code files to identify SDKs and network behavior.\n
- Boundary markers: There are no delimiters or instructions provided to the agent to disregard malicious instructions embedded within the analyzed project files.\n
- Capability inventory: The skill can generate keystores, modify build scripts, and execute shell validation commands.\n
- Sanitization: The skill lacks sanitization or validation logic for the content it ingests from the developer's project files.
Audit Metadata