app-store-testflight
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The launcher script
scripts/asc.mjsattempts to download the core CLI tool from the author's official GitHub repository (https://github.com/beydemirfurkan/appstore-release.git) usinggit cloneif it's not found locally. This behavior is documented and follows standard practices for skill loaders fetching their own vendor-maintained dependencies. - [COMMAND_EXECUTION]: The skill executes the downloaded or locally resolved CLI using
node.child_process.spawnSync. The execution is scoped to theasctool for managing App Store Connect builds and utilizes environment-provided credentials. - [SAFE]: The skill follows security best practices by recommending that credentials (API keys) are supplied via environment variables only, rather than being hardcoded or stored in cleartext configuration files.
Audit Metadata