gpc-migrate-fastlane

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read local configuration files which could harbor malicious instructions if sourced from an untrusted project.
  • Ingestion points: The skill procedure in SKILL.md performs cat operations on fastlane/Fastfile and fastlane/Appfile to identify existing configurations.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of these files as untrusted data.
  • Capability inventory: The skill utilizes capabilities for shell command execution (gpc CLI commands), package installation (npm install), and file system management (ls, cat, rm).
  • Sanitization: No sanitization or validation logic is present to filter the content of ingested configuration files.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @gpc-cli/cli package from the NPM registry as its primary function.
  • Installation instructions include npm install -g @gpc-cli/cli and dynamic execution via npx @gpc-cli/cli in CI examples.
  • This dependency is a vendor-owned resource associated with the migration tool's functionality.
  • [COMMAND_EXECUTION]: The skill employs shell commands for environment detection and providing migration examples.
  • A detection script scripts/detect_gpc.mjs uses execSync to run hardcoded gpc and npx commands to verify installation and configuration status.
  • SKILL.md and referenced documentation provide various CLI examples for managing Play Store releases, metadata, and CI/CD integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 07:00 PM