asc-screenshots

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The launcher script in scripts/asc.mjs is designed to download the appstore-release CLI tool from the author's GitHub repository (https://github.com/beydemirfurkan/appstore-release.git) if the tool is not already found in the local environment or cache.\n- [REMOTE_CODE_EXECUTION]: Once the external repository is cloned, the skill executes the logic contained within src/cli.mjs using the Node.js runtime. The launcher validates the package name in package.json before proceeding with execution.\n- [COMMAND_EXECUTION]: The skill uses the node:child_process module to spawn shell processes for git (to clone the CLI) and node (to run the CLI). Additionally, the documentation instructs the agent to use xcrun simctl for simulator captures and suggests using headless Chrome or Chromium to render HTML mockups.\n- [DYNAMIC_EXECUTION]: The script scripts/asc.mjs dynamically resolves the path to the CLI executable at runtime based on environment variables, local directory structures, or a specific versioned cache directory (~/.cache/appstore-release/v3.0.0), subsequently executing the resolved path.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides functionality to render HTML mockups provided by the user into PNG screenshots using a headless browser. While this creates an ingestion point for potentially untrusted HTML content, the risk is mitigated by the local nature of the rendering process and its alignment with the skill's primary purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 03:33 PM