asc-metadata-sync

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No security issues detected. The skill defines a clear, security-conscious workflow for managing App Store Connect metadata using the asc utility. It emphasizes the use of validation, dry runs, and deterministic version selectors.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external metadata and local files, which serves as an ingestion surface for potential instructions embedded in app descriptions or localizations.
  • Ingestion points: Metadata pulled from App Store Connect and local files including .json, .csv, and .strings (e.g., metadata/app-info/<locale>.json).
  • Boundary markers: The instructions do not explicitly define delimiters for processed metadata content.
  • Capability inventory: The skill uses the asc tool to perform network operations (pull/push/upload) and local file operations.
  • Sanitization: The skill relies on built-in tool validation via the asc metadata validate command.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 12:55 PM