asc-credentials
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/asc.mjsis configured to fetch theappstore-releaseCLI directly from the author's GitHub repository (https://github.com/beydemirfurkan/appstore-release.git) if a local copy is not found. - [REMOTE_CODE_EXECUTION]: The launcher script clones a remote repository and subsequently executes a JavaScript file (
src/cli.mjs) from the downloaded content using thenoderuntime. - [COMMAND_EXECUTION]: The skill uses
child_process.spawnSyncto execute shell commands, includinggit clonefor dependency retrieval andnodefor running the resolved CLI script. - [DYNAMIC_EXECUTION]: The script dynamically calculates the execution path for the CLI at runtime based on environment variables (
APPSTORE_RELEASE_HOME,CLAUDE_PLUGIN_ROOT) or a versioned local cache directory. - [DATA_EXFILTRATION]: The skill communicates with Apple's App Store Connect API (
api.appstoreconnect.apple.com) to manage highly sensitive data, including Apple Distribution certificates and private keys.
Audit Metadata