gpc-migrate-fastlane
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@gpc-cli/clipackage from the NPM registry. This package belongs to the vendor 'yasserstudio'.\n- [REMOTE_CODE_EXECUTION]: Executes the GPC CLI tool vianpxin migration procedures and CI/CD workflows. Additionally, thescripts/detect_gpc.mjsscript usesnode:child_processto execute shell commands likegpc --versionandgpc auth statusto programmatically check the environment status.\n- [COMMAND_EXECUTION]: Performs several shell operations including installing NPM packages, executing GPC deployment tasks, and using standard utilities likecat,ls, andrm -rfto handle Fastlane configuration files.\n- [PROMPT_INJECTION]: The skill's migration logic involves processing local project files, which creates a surface for indirect prompt injection.\n - Ingestion points: Reads content from
fastlane/Fastfile,fastlane/Appfile, and thefastlane/metadata/android/directory (SKILL.md).\n - Boundary markers: No explicit markers or delimiters are used to differentiate project data from agent instructions.\n
- Capability inventory: The skill can install software via
npm, delete local files viarm, and perform production app releases via the Play Store API.\n - Sanitization: No validation or sanitization of the ingested file content is performed before processing.
Audit Metadata