gpc-multi-app
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill provides legitimate automation templates for the GPC CLI tool and follows best practices for secret management in CI/CD pipelines.- [COMMAND_EXECUTION]: The environment detection script
scripts/detect_gpc.mjsexecutes local GPC commands to verify installation and authentication status. These commands are hardcoded and do not process external input.- [INDIRECT_PROMPT_INJECTION]: The skill provides shell script templates for batch processing multiple apps, which interpolate package names into commands. This represents a potential injection surface if the package names originate from untrusted data, though the examples follow standard shell quoting practices. - Ingestion points: Package names provided by the user or read from project
.gpcrc.jsonfiles. - Boundary markers: None explicitly defined in the templates.
- Capability inventory: Shell execution of GPC CLI commands across multiple scripts and CI workflows.
- Sanitization: Scripts use standard shell variable quoting (e.g.,
"$app") to mitigate basic word-splitting exploits.
Audit Metadata