asc-metadata-sync
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill defines a clear, security-conscious workflow for managing App Store Connect metadata using the
ascutility. It emphasizes the use of validation, dry runs, and deterministic version selectors. - [INDIRECT_PROMPT_INJECTION]: The skill processes external metadata and local files, which serves as an ingestion surface for potential instructions embedded in app descriptions or localizations.
- Ingestion points: Metadata pulled from App Store Connect and local files including
.json,.csv, and.strings(e.g.,metadata/app-info/<locale>.json). - Boundary markers: The instructions do not explicitly define delimiters for processed metadata content.
- Capability inventory: The skill uses the
asctool to perform network operations (pull/push/upload) and local file operations. - Sanitization: The skill relies on built-in tool validation via the
asc metadata validatecommand.
Audit Metadata