gpc-monetization

Pass

Audited by Gen Agent Trust Hub on Mar 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines various command-line operations using the gpc tool to interact with monetization APIs. These commands allow listing, creating, and updating in-app products and subscriptions.\n- [PROMPT_INJECTION]: The skill instructions allow the agent to process external data from local files (e.g., product.json, subscription.json) which could serve as a surface for indirect prompt injection.\n
  • Ingestion points: SKILL.md contains commands like gpc products create --file product.json that read data from the local file system.\n
  • Boundary markers: No specific delimiters or safety instructions are used to separate the JSON content from the agent's instructions.\n
  • Capability inventory: The skill possesses the capability to execute shell commands using the gpc utility as seen in SKILL.md.\n
  • Sanitization: No explicit sanitization or validation of the JSON file contents is performed by the skill before being passed to the CLI tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 8, 2026, 12:40 PM