apple-appstore-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze external repositories, creating a vector where malicious instructions embedded in source code or project metadata could attempt to influence the agent's behavior.
- Ingestion points: The skill explicitly instructs the agent to locate and inspect project files including
Info.plist,*.entitlements,PrivacyInfo.xcprivacy, StoreKit configurations, and general application source code. - Boundary markers: There are no explicit instructions to use delimiters or ignore embedded natural language instructions found within the project files.
- Capability inventory: The skill restricts the agent to observation and reporting; it specifically mandates 'Change no code initially' and 'Do not edit code or propose PRs in the first pass,' which significantly limits the potential impact of an injection.
- Sanitization: The instructions do not include procedures for sanitizing or escaping content extracted from the analyzed codebase before it is integrated into the agent's context.
Audit Metadata