Google Play Store API - App Search, Install Counts, Reviews

• Outcome: Pass
• Latest audit: Oct 11, 2026 · 1:48 PM UTC
• Version: 1.0.4

Overview

This skill is a coherent Google Play data API helper that discloses its external Scavio API use and does not show hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable using Scavio as a third-party API provider. Keep SCAVIO_API_KEY in your environment or secret store, do not commit it, and confirm cost and locale choices before large review crawls because each endpoint call is billed in credits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search - one shelf of ~30 apps, no pagination
apps = requests.post(f"{BASE}/api/v1/googleplay/search", headers=HEADERS,
    json={"query": "habit tracker", "hl": "en", "gl": "us"}).json()

# 2. Full listing - package name or any play.google.com URL

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

json={"query": "habit tracker", "hl": "en", "gl": "us"}).json()

# 2. Full listing - package name or any play.google.com URL
app = requests.post(f"{BASE}/api/v1/googleplay/app", headers=HEADERS,
    json={"app_id": "com.spotify.music"}).json()

# The 20 server-rendered reviews are already in there - do not pay again for them.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

The 20 server-rendered reviews are already in there - do not pay again for them.

3. Page past them, sorted by rating

reviews = requests.post(f"{BASE}/api/v1/googleplay/reviews", headers=HEADERS, json={"app_id": "com.spotify.music", "sort": "rating", "count": 200}).json()

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

The 20 server-rendered reviews are already in there - do not pay again for them.

3. Page past them, sorted by rating

reviews = requests.post(f"{BASE}/api/v1/googleplay/reviews", headers=HEADERS, json={"app_id": "com.spotify.music", "sort": "rating", "count": 200}).json()

text

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

- Every call is **2 credits**, not 1. Say so before planning a multi-page crawl: a 10-page review pull is 20 credits.
- `/app` already contains 20 reviews. Do not call `/reviews` for the same app unless you need to go deeper or change the sort - that is a second premium call for data you already have.
- Search is one shelf of ~30 apps with **no pagination**. Never tell the user there is a page 2; narrow the query instead.
- Keep `sort` fixed while paging reviews. The cursor carries the sort, and changing it mid-walk invalidates the sequence.
- Do not treat a `404` mid-walk as a failure - a cursor past the last review is how the feed ends.
- Games are folded into the apps vertical and are covered. **Books and films are not** - they use a different card shape entirely.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The parameter tables define hl defaulting to en and gl defaulting to us, and later examples consistently use those defaults. Because the skill changes storefront content based on these values, defaulting to a specific locale can violate language/locale policy when no user choice or opt-in is mentioned.

Content

No source excerpt is available for this finding.