asc-apple-ads
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes asc CLI commands for managing Apple Search Ads campaigns, ad groups, and reports.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages authentication via environment variables and file paths such as ~/.asc/apple-ads-private-key.pem. This is standard configuration for the asc tool and no unauthorized data exfiltration was detected.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local JSON files via the --file flag, creating an attack surface for indirect prompt injection if those files are generated from untrusted sources.
- Ingestion points: Local JSON files (e.g., campaign.json, reporting-request.json) specified in SKILL.md.
- Boundary markers: None present.
- Capability inventory: The skill can create, update, and delete ad resources and execute raw API requests via the CLI.
- Sanitization: None documented.
Audit Metadata