The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/asc.mjs is designed to download and execute code from an external repository during operation.\n
The cloneIntoCache function utilizes git clone to fetch the appstore-release repository from https://github.com/beydemirfurkan/appstore-release.git.\n
The main function then executes the entry point of the cloned repository (src/cli.mjs) using the current Node.js process via spawnSync.\n
This mechanism enables the execution of remote code that is not bundled with the skill and has not undergone security review.\n- [EXTERNAL_DOWNLOADS]: The skill initiates network requests to download its core execution logic from a third-party source.\n
The hardcoded URL https://github.com/beydemirfurkan/appstore-release.git is targeted for cloning the CLI tool.\n- [COMMAND_EXECUTION]: The launcher script executes shell commands using spawnSync to perform its operations.\n
It invokes git to clone the repository and node to run the downloaded scripts.\n
User-supplied arguments are passed directly to the subprocess, creating a potential command injection surface if inputs are not properly validated by the underlying CLI.\n- [DYNAMIC_EXECUTION]: The skill determines and executes code paths at runtime based on environmental discovery and external repository cloning.\n
The script dynamically resolves the path to the CLI tool and executes it using spawnSync(process.execPath, [cli, ...argv]).\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing user-generated input to construct API configuration.\n
Ingestion points: User-provided answers to the age-rating questionnaire described in SKILL.md.\n
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to disregard instructions potentially embedded within the user's answers.\n
Capability inventory: The skill has the capability to write configuration data to the App Store Connect API and execute local scripts using environment-stored credentials.\n
Sanitization: No sanitization, escaping, or strict schema validation is mentioned for the user-provided answers before they are interpolated into the ageRating JSON object.

asc-age-rating