asc-screenshots
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The launcher script in
scripts/asc.mjsis designed to download theappstore-releaseCLI tool from the author's GitHub repository (https://github.com/beydemirfurkan/appstore-release.git) if the tool is not already found in the local environment or cache.\n- [REMOTE_CODE_EXECUTION]: Once the external repository is cloned, the skill executes the logic contained withinsrc/cli.mjsusing the Node.js runtime. The launcher validates the package name inpackage.jsonbefore proceeding with execution.\n- [COMMAND_EXECUTION]: The skill uses thenode:child_processmodule to spawn shell processes forgit(to clone the CLI) andnode(to run the CLI). Additionally, the documentation instructs the agent to usexcrun simctlfor simulator captures and suggests using headless Chrome or Chromium to render HTML mockups.\n- [DYNAMIC_EXECUTION]: The scriptscripts/asc.mjsdynamically resolves the path to the CLI executable at runtime based on environment variables, local directory structures, or a specific versioned cache directory (~/.cache/appstore-release/v3.0.0), subsequently executing the resolved path.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides functionality to render HTML mockups provided by the user into PNG screenshots using a headless browser. While this creates an ingestion point for potentially untrusted HTML content, the risk is mitigated by the local nature of the rendering process and its alignment with the skill's primary purpose.
Audit Metadata