gpc-migrate-fastlane
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read local configuration files which could harbor malicious instructions if sourced from an untrusted project.
- Ingestion points: The skill procedure in
SKILL.mdperformscatoperations onfastlane/Fastfileandfastlane/Appfileto identify existing configurations. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of these files as untrusted data.
- Capability inventory: The skill utilizes capabilities for shell command execution (
gpcCLI commands), package installation (npm install), and file system management (ls,cat,rm). - Sanitization: No sanitization or validation logic is present to filter the content of ingested configuration files.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
@gpc-cli/clipackage from the NPM registry as its primary function. - Installation instructions include
npm install -g @gpc-cli/cliand dynamic execution vianpx @gpc-cli/cliin CI examples. - This dependency is a vendor-owned resource associated with the migration tool's functionality.
- [COMMAND_EXECUTION]: The skill employs shell commands for environment detection and providing migration examples.
- A detection script
scripts/detect_gpc.mjsusesexecSyncto run hardcodedgpcandnpxcommands to verify installation and configuration status. SKILL.mdand referenced documentation provide various CLI examples for managing Play Store releases, metadata, and CI/CD integration.
Audit Metadata