app-store-submission
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/asc_submit.pyexecutes shell commands viasubprocess.runto call a local companion Swift script (scripts/asc_jwt.swift) for JWT generation. This is a controlled execution of a local, bundled resource and does not involve untrusted input. - [DATA_EXPOSURE_EXFILTRATION]: While the skill manages sensitive App Store Connect API keys, it explicitly instructs users to store them in a gitignored
.envfile and keep the.p8private key file in a secure local directory (~/.appstoreconnect/private_keys/) outside the repository, preventing accidental exposure. - [REMOTE_CODE_EXECUTION]: The skill uses
urllib.requestto interact with the official App Store Connect API (api.appstoreconnect.apple.com). These network operations are standard for the skill's primary purpose and target well-known, trusted service domains. - [PRIVILEGE_ESCALATION]: The instructions suggest using
chmod 600on the private key file. This is a security best practice to restrict file access to the owner and does not constitute malicious privilege escalation.
Audit Metadata