asc-metadata-sync

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill documents standard administrative workflows for App Store Connect metadata management using the asc CLI tool. All described operations are consistent with the skill's stated purpose of syncing and validating metadata.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from remote App Store records and local files, which represents a potential injection surface.
  • Ingestion points: External data is ingested via asc metadata pull, localization downloads, and CSV imports (--input "./keywords.csv").
  • Boundary markers: Data is maintained in structured formats including JSON (app-info/<locale>.json), CSV, and .strings files.
  • Capability inventory: The skill can update remote App Store metadata via asc metadata push, asc apps info edit, and asc localizations upload commands.
  • Sanitization: The skill explicitly instructs the agent to run asc metadata validate and asc migrate validate before any remote writes, and encourages the use of --dry-run to preview changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:33 PM