store-assets
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the macOS 'sips' utility to verify and resize images, and the 'pnpm' package manager to execute local scripts for uploading assets. These operations are restricted to project-specific paths and are standard for the described app publishing workflow.- [DYNAMIC_EXECUTION]: A self-contained Python script is embedded in 'sizes.md' to automate the verification of image dimensions for Android assets. This script runs locally using standard libraries to call the 'sips' utility and does not involve remote code retrieval or arbitrary user input execution.- [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for ingesting user data to generate image prompts, which is a potential surface for indirect injection. * Ingestion points: User-provided metadata including the app display name, primary benefits, and hex color codes collected during 'Brand intake'. * Boundary markers: The instructions do not define specific delimiters or warning markers to isolate user-provided text within the final image generation prompts. * Capability inventory: The skill has access to local file system operations via 'sips' and 'pnpm', and interacts with image generation tools. * Sanitization: No specific sanitization logic is implemented for the text data before it is interpolated into the prompts.
Audit Metadata