asc-reviews

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/asc.mjs script uses spawnSync to execute the Node.js CLI and git commands.
  • It executes the local CLI tool located at src/cli.mjs within the resolved package directory.
  • It executes git clone to fetch the CLI source code if it is not found locally.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to download its functional core (the appstore-release CLI) from a remote repository if it's not already present on the system.
  • It targets https://github.com/beydemirfurkan/appstore-release.git, which is the official repository belonging to the skill's author.
  • [REMOTE_CODE_EXECUTION]: The script downloads code via Git and subsequently executes it using the Node.js runtime.
  • This behavior is transparently documented in the script's comments as a way to "close the gap" between the skill instructions and the required CLI tool, ensuring version parity between the two.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 04:38 PM