release-notes
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a CLI tool named
asoto pull app metadata from the App Store. This tool is a vendor-specific resource associated with the author 'ASOManiac' and is used as intended for App Store Optimization tasks. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads localized metadata files (name, subtitle, keywords) from a local directory created by the metadata pull command. This access is necessary for providing context to the release note generation process and does not involve exfiltration of sensitive user data.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (App Store metadata). While this presents a theoretical attack surface for indirect prompt injection, the data is used in a controlled manner to generate text drafts, and no high-risk capabilities are exposed to this data.
Audit Metadata