The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches app metadata from the Apple iTunes Search API at itunes.apple.com. This is a well-known, official service used for retrieving public application information and does not pose a security risk.
[COMMAND_EXECUTION]: The provided Python scripts (e.g., aso_scorer.py, keyword_analyzer.py) perform local data processing, statistical calculations, and text analysis using standard libraries. They do not utilize dangerous functions like eval(), exec(), or subprocess to run arbitrary system commands.
[DATA_EXFILTRATION]: No access to sensitive local files, credentials, or environment variables was identified. Network activity is strictly limited to retrieving public data from trusted app store domains.
[PROMPT_INJECTION]: The skill instructions and browsing templates in scraper.py are well-structured for their intended purpose. They do not contain instructions to bypass AI safety filters, extract system prompts, or override agent constraints.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted data from the web (app reviews and descriptions), the processing is handled via Python-based regex and frequency analysis rather than direct interpolation into agent prompts, which significantly reduces the risk of malicious instruction execution from external content.

app-store-optimisation-codex