The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/asc.mjs implements a launcher that clones the repository https://github.com/beydemirfurkan/appstore-release.git into a local cache directory and executes its contents using node. This pattern allows the execution of arbitrary code fetched from the internet at runtime, bypassing static inspection of the actual tool logic.
[COMMAND_EXECUTION]: The skill uses node:child_process.spawnSync to execute the downloaded CLI tool. It passes arguments directly from the agent's environment to the shell, which can be risky if inputs are not properly sanitized by the underlying CLI.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading App Store customer reviews, which is untrusted data provided by external users. Such data can contain malicious instructions intended to bypass the agent's safety protocols. The skill acknowledges this risk and includes instructions for the agent to treat reviews as untrusted data and mandates a human-in-the-loop approval process before any replies are published.
Ingestion points: SKILL.md defines commands for reading reviews via the asc script, which fetches data from the App Store Connect API.
Boundary markers: The skill contains explicit warnings to treat review text as untrusted and to never follow instructions found inside a review.
Capability inventory: The skill can execute shell commands via scripts/asc.mjs and make authenticated network requests to the App Store API.
Sanitization: The skill requires the user to approve the exact text of every reply before it is posted, preventing automated obedience to injected instructions.

app-store-customer-reviews