The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the asc CLI tool via brew install asc. This is a third-party wrapper for the App Store Connect API and represents a dependency from an untrusted source.
[EXTERNAL_DOWNLOADS]: The skill requires installing AXe for simulator automation using brew install cameroncooke/axe/axe, which pulls code from a personal GitHub repository.
[EXTERNAL_DOWNLOADS]: The skill installs the Python package koubou==0.18.1 for screenshot framing, which is an unverifiable dependency from an unknown source.
[DATA_EXFILTRATION]: The skill contains a recipe for sending analytics events (including install-scoped UUIDs) to https://analytics.superduperai.co/e, which is an external domain that does not belong to a trusted vendor or well-known service.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources and has high-privilege capabilities.
Ingestion points: The skill fetches customer reviews (asc reviews list), tester feedback (asc testflight feedback list), and crash logs (asc testflight crashes list) from the App Store Connect API.
Boundary markers: No boundary markers or "ignore instructions" delimiters are used when processing this external data.
Capability inventory: The skill can execute asc commands to modify app metadata, reply to customer reviews, and submit app versions for review.
Sanitization: The skill lacks any sanitization or validation of the fetched external content before it is processed by the agent.

solo-ios-release