zk-app-store-links
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses official Apple domains (apple.com) for app metadata lookups and downloading SVG badge artwork. These operations are restricted to well-known service endpoints for their intended marketing purpose.
- [INDIRECT_PROMPT_INJECTION]: The instructions involve reading application identifiers from local project files (config, env, constants) to populate links and meta tags. While this represents a data ingestion surface, the context is limited to standard development workflows with no significant risk of exploitation or privilege escalation.
- [COMMAND_EXECUTION]: The skill provides curl commands to verify app IDs and download assets. These commands target official Apple developer and marketing APIs and do not involve piped execution or untrusted remote scripts.
Audit Metadata