app-store-age-rating
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/asc.mjslauncher fetches theappstore-releaseCLI tool from the author's GitHub repository (github.com/beydemirfurkan/appstore-release.git) to the local cache directory. - [REMOTE_CODE_EXECUTION]: The skill executes the downloaded CLI using
nodeviaspawnSyncto perform age-rating updates on App Store Connect. - [COMMAND_EXECUTION]: The launcher script invokes
git cloneto retrieve the CLI andnodeto run it, using an array-based argument passing method that prevents shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill relies on natural language interviews to gather app content details, which are then used to populate the API request.
- Ingestion points: User answers concerning violence, sexual content, and social features in
SKILL.mdandreferences/questionnaire.md. - Boundary markers: No specific delimiters or instructions are provided to separate user-provided content from the agent's logic.
- Capability inventory: Executes network operations to
api.appstoreconnect.apple.comvia theascscript. - Sanitization: The instructions do not define sanitization or validation logic for the user's content descriptions before they are processed by the CLI.
Audit Metadata