appmate-setup
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the installation of Python dependencies via
pip install -r requirements.txt. References to the App Store Connect API involve interaction with a well-known service from a recognized technology provider. - [COMMAND_EXECUTION]: The skill executes several local Python scripts (
scripts/appmate_config.py,scripts/asc_client.py,scripts/key_safety.py) during the setup and self-check phases to validate environment configuration, verify authentication, and check API key permissions. - [SAFE]: The skill demonstrates robust security handling of sensitive credentials. It explicitly instructs the agent to store API keys in a gitignored
config/directory to prevent exposure. It also mandates the use of read-only API roles and includes a runtime safety probe that checks endpoints like/v1/bundleIdsand/v1/financeReportsto identify and block the use of over-privileged keys (e.g., Admin or Developer roles), adhering to the principle of least privilege.
Audit Metadata