asc-metadata-sync
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the asc CLI utility to manage App Store Connect resources. It performs operations such as listing, downloading, and uploading localizations, as well as updating app information and version metadata (SKILL.md).\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external data files, creating a potential surface for indirect prompt injection.\n
- Ingestion points: The agent reads localization files (.strings) and legacy metadata files from directories like ./localizations and ./fastlane as specified in SKILL.md.\n
- Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish between data and potential instructions within the processed files.\n
- Capability inventory: The skill allows for command execution via the asc tool and interacts with the file system for reads and writes across all documented workflows.\n
- Sanitization: Validation tools such as asc metadata validate and asc migrate validate are mentioned for checking schema and character limits, but they do not provide explicit protection against malicious prompt injection content.
Audit Metadata