asc-metadata-sync
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documents standard administrative workflows for App Store Connect metadata management using the
ascCLI tool. All described operations are consistent with the skill's stated purpose of syncing and validating metadata. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from remote App Store records and local files, which represents a potential injection surface.
- Ingestion points: External data is ingested via
asc metadata pull, localization downloads, and CSV imports (--input "./keywords.csv"). - Boundary markers: Data is maintained in structured formats including JSON (
app-info/<locale>.json), CSV, and.stringsfiles. - Capability inventory: The skill can update remote App Store metadata via
asc metadata push,asc apps info edit, andasc localizations uploadcommands. - Sanitization: The skill explicitly instructs the agent to run
asc metadata validateandasc migrate validatebefore any remote writes, and encourages the use of--dry-runto preview changes.
Audit Metadata