app-store-age-rating

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/asc.mjs launcher fetches the appstore-release CLI tool from the author's GitHub repository (github.com/beydemirfurkan/appstore-release.git) to the local cache directory.
  • [REMOTE_CODE_EXECUTION]: The skill executes the downloaded CLI using node via spawnSync to perform age-rating updates on App Store Connect.
  • [COMMAND_EXECUTION]: The launcher script invokes git clone to retrieve the CLI and node to run it, using an array-based argument passing method that prevents shell injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill relies on natural language interviews to gather app content details, which are then used to populate the API request.
  • Ingestion points: User answers concerning violence, sexual content, and social features in SKILL.md and references/questionnaire.md.
  • Boundary markers: No specific delimiters or instructions are provided to separate user-provided content from the agent's logic.
  • Capability inventory: Executes network operations to api.appstoreconnect.apple.com via the asc script.
  • Sanitization: The instructions do not define sanitization or validation logic for the user's content descriptions before they are processed by the CLI.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 05:59 PM