app-store-screenshots

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to interact with local development tools including xcrun simctl for simulator control, axe for accessibility automation, and asc (App Store Connect CLI) for store management. These are standard developer workflows for iOS automation.
  • [EXTERNAL_DOWNLOADS]: The documentation references several third-party open-source tools necessary for the pipeline, such as XcodeBuildMCP and App-Store-Connect-CLI. These are hosted on GitHub by established community contributors and are standard dependencies for this type of workflow.
  • [REMOTE_CODE_EXECUTION]: The compositor script (generate.py) invokes Google Chrome in headless mode using subprocess.run. It points Chrome to locally generated HTML files (file:// protocol) to render screenshots. This is a controlled execution environment for image generation.
  • [DATA_EXPOSURE]: The skill requires authentication for the App Store Connect API to function, but it correctly instructs users to manage these via the asc CLI's native authentication mechanisms rather than hardcoding keys. The scripts process local screenshot files and local JSON configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 11:57 AM
Security Audit — agent-trust-hub — app-store-screenshots