app-store-screenshots
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
subprocess.runto interact with local development tools includingxcrun simctlfor simulator control,axefor accessibility automation, andasc(App Store Connect CLI) for store management. These are standard developer workflows for iOS automation. - [EXTERNAL_DOWNLOADS]: The documentation references several third-party open-source tools necessary for the pipeline, such as
XcodeBuildMCPandApp-Store-Connect-CLI. These are hosted on GitHub by established community contributors and are standard dependencies for this type of workflow. - [REMOTE_CODE_EXECUTION]: The compositor script (
generate.py) invokes Google Chrome in headless mode usingsubprocess.run. It points Chrome to locally generated HTML files (file://protocol) to render screenshots. This is a controlled execution environment for image generation. - [DATA_EXPOSURE]: The skill requires authentication for the App Store Connect API to function, but it correctly instructs users to manage these via the
ascCLI's native authentication mechanisms rather than hardcoding keys. The scripts process local screenshot files and local JSON configuration.
Audit Metadata