gpc-monetization
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines various command-line operations using the
gpctool to interact with monetization APIs. These commands allow listing, creating, and updating in-app products and subscriptions.\n- [PROMPT_INJECTION]: The skill instructions allow the agent to process external data from local files (e.g.,product.json,subscription.json) which could serve as a surface for indirect prompt injection.\n - Ingestion points:
SKILL.mdcontains commands likegpc products create --file product.jsonthat read data from the local file system.\n - Boundary markers: No specific delimiters or safety instructions are used to separate the JSON content from the agent's instructions.\n
- Capability inventory: The skill possesses the capability to execute shell commands using the
gpcutility as seen inSKILL.md.\n - Sanitization: No explicit sanitization or validation of the JSON file contents is performed by the skill before being passed to the CLI tool.
Audit Metadata