asc-credentials

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/asc.mjs is configured to fetch the appstore-release CLI directly from the author's GitHub repository (https://github.com/beydemirfurkan/appstore-release.git) if a local copy is not found.
  • [REMOTE_CODE_EXECUTION]: The launcher script clones a remote repository and subsequently executes a JavaScript file (src/cli.mjs) from the downloaded content using the node runtime.
  • [COMMAND_EXECUTION]: The skill uses child_process.spawnSync to execute shell commands, including git clone for dependency retrieval and node for running the resolved CLI script.
  • [DYNAMIC_EXECUTION]: The script dynamically calculates the execution path for the CLI at runtime based on environment variables (APPSTORE_RELEASE_HOME, CLAUDE_PLUGIN_ROOT) or a versioned local cache directory.
  • [DATA_EXFILTRATION]: The skill communicates with Apple's App Store Connect API (api.appstoreconnect.apple.com) to manage highly sensitive data, including Apple Distribution certificates and private keys.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 03:33 PM