gpc-migrate-fastlane

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @gpc-cli/cli package from the NPM registry. This package belongs to the vendor 'yasserstudio'.\n- [REMOTE_CODE_EXECUTION]: Executes the GPC CLI tool via npx in migration procedures and CI/CD workflows. Additionally, the scripts/detect_gpc.mjs script uses node:child_process to execute shell commands like gpc --version and gpc auth status to programmatically check the environment status.\n- [COMMAND_EXECUTION]: Performs several shell operations including installing NPM packages, executing GPC deployment tasks, and using standard utilities like cat, ls, and rm -rf to handle Fastlane configuration files.\n- [PROMPT_INJECTION]: The skill's migration logic involves processing local project files, which creates a surface for indirect prompt injection.\n
  • Ingestion points: Reads content from fastlane/Fastfile, fastlane/Appfile, and the fastlane/metadata/android/ directory (SKILL.md).\n
  • Boundary markers: No explicit markers or delimiters are used to differentiate project data from agent instructions.\n
  • Capability inventory: The skill can install software via npm, delete local files via rm, and perform production app releases via the Play Store API.\n
  • Sanitization: No validation or sanitization of the ingested file content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 01:58 PM