asc-reviews
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/asc.mjsscript usesspawnSyncto execute the Node.js CLI andgitcommands. - It executes the local CLI tool located at
src/cli.mjswithin the resolved package directory. - It executes
git cloneto fetch the CLI source code if it is not found locally. - [EXTERNAL_DOWNLOADS]: The skill is designed to download its functional core (the
appstore-releaseCLI) from a remote repository if it's not already present on the system. - It targets
https://github.com/beydemirfurkan/appstore-release.git, which is the official repository belonging to the skill's author. - [REMOTE_CODE_EXECUTION]: The script downloads code via Git and subsequently executes it using the Node.js runtime.
- This behavior is transparently documented in the script's comments as a way to "close the gap" between the skill instructions and the required CLI tool, ensuring version parity between the two.
Audit Metadata