aso
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform ASO tasks, including keyword analysis (
aso keywords analyze), recommendation (aso keywords recommend), and app deployment (fastlane deliver). It also checks for the presence of CLI tools usingcommand -v. - [EXTERNAL_DOWNLOADS]: The skill manages its environment by verifying and potentially installing
fastlanevia Homebrew (brew install fastlane). It also references the installation of theasoCLI, which is an internal tool provided by the vendor 'asomaniac'. - [DATA_EXFILTRATION]: The skill interacts with the App Store Connect API and local fastlane metadata files to manage app storefront information. It checks authentication status using
aso auth maniac statusas part of its primary functionality. - [PROMPT_INJECTION]: The skill includes internal routing logic and "Iron Law" instructions to ensure the agent scopes requests before execution, which are standard behavioral guidelines.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests user-provided data such as App IDs, seed keywords, and storefront codes, as well as external data returned from the
asoCLI tool. - Boundary markers: Not explicitly defined in the prompt templates.
- Capability inventory: The skill possesses the capability to execute shell commands, write to the local filesystem (
fastlane/metadata/), and initiate network requests via external CLI tools. - Sanitization: No explicit sanitization or validation of user-provided seeds or storefront codes is described before they are interpolated into shell commands.
Audit Metadata