The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of the asc CLI tool and a Node.js script (scripts/asc-api.mjs) to perform App Store management tasks. This is standard functionality for the skill's purpose.
[DATA_EXFILTRATION]: The skill's API script reads sensitive private key files (.p8) to authenticate with App Store Connect. These keys are used to sign tokens that are transmitted only to the official Apple API domain (api.appstoreconnect.apple.com). The skill includes explicit warnings against insecure handling of these credentials.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential surface for indirect prompt injection.
Ingestion points: The asc reviews list command retrieves customer reviews from the App Store, which are provided by external, untrusted users.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the retrieved review text.
Capability inventory: The skill has the capability to execute shell commands, perform network requests, and read local files.
Sanitization: No explicit sanitization or filtering of the review content is performed before it is presented to the agent.

appstore-connect