app-store-review-arbitrage
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted review text from external app stores via
scripts/fetch_reviews.py. This content is processed inSKILL.md(Steps 3 and 5) to generate verbatim quotes and marketing headlines. A malicious review could potentially contain instructions aimed at influencing the agent's behavior. \n - Ingestion points: External review data is stored in
{tmpdir}/asr-raw.jsonafter being fetched from App Store or Google Play. \n - Boundary markers: The instructions do not define specific delimiters or warnings for the agent when processing the fetched review text. \n
- Capability inventory: The skill executes shell commands (via
scripts/fetch_reviews.py) and writes files to thedocs/directory. \n - Sanitization: There is no mention of sanitizing or filtering the body of the reviews before analysis.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
google-play-scraper, which is a well-known and widely used open-source Python library for accessing public Play Store data.\n- [COMMAND_EXECUTION]: The skill executes a bundled script,scripts/fetch_reviews.py, to perform data collection. The URL input is validated against specific platform patterns (e.g., matchingapps.apple.comorplay.google.com) and specific ID formats are extracted before the script is called, which helps mitigate command injection risks.
Audit Metadata