The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The launcher script scripts/asc.mjs is designed to download and execute code from an external source at runtime. If the required CLI tool is not found locally, it clones a remote repository (https://github.com/beydemirfurkan/appstore-release.git) and executes its entry point (src/cli.mjs) using the current node process via spawnSync. This pattern allows for the execution of arbitrary, unverified code that is not contained within the skill's own instructions or scripts.
[EXTERNAL_DOWNLOADS]: The skill initiates network connections to GitHub to clone the appstore-release repository. It also requires network access to api.appstoreconnect.apple.com to interact with Apple's App Store Connect API.
[COMMAND_EXECUTION]: The launcher script invokes system commands including git clone to fetch the external repository and node to execute the downloaded CLI. Additionally, the skill documentation indicates a dependency on openssl being available on the system PATH for certificate processing and export.
[DATA_EXFILTRATION]: The skill handles extremely sensitive credentials, including Apple Distribution private keys (dist.key), P12 certificates (dist.p12), and passwords stored in credentials.json. While the documentation claims to set restrictive file permissions (0600), the processing and storage of these secrets by unverified external code fetched at runtime poses a high risk of data exposure.

ios-code-signing