Skills
Navigate
skills/beydemirfurkan/appstore-release/app-store-screenshot-upload/Gen Agent Trust Hub

app-store-screenshot-upload

Fail

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/asc.mjs performs a git clone of a remote repository (https://github.com/beydemirfurkan/appstore-release.git) and executes its content using spawnSync. This allows for the execution of unverified remote code on the host machine.
  • [EXTERNAL_DOWNLOADS]: Core components of the skill are fetched from a non-trusted GitHub user account at runtime, bypassing static analysis of the actual logic.
  • [COMMAND_EXECUTION]: The skill uses spawnSync to execute shell commands such as git and node, enabling interactions with the host system that are dependent on remote content.
  • [DYNAMIC_EXECUTION]: The executable path is resolved dynamically at runtime, pointing to code within a cache directory that is populated by external downloads.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external files (images and directories) whose metadata or properties could potentially influence the agent's behavior if processed without sanitization. Ingestion points: dir and from configuration paths in SKILL.md. Boundary markers: Absent. Capability inventory: spawnSync for Git and Node.js CLI execution in scripts/asc.mjs. Sanitization: None detected in the launcher script.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 10, 2026, 05:59 PM