asc-shots-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several shell scripts and commands to automate iOS build and simulator tasks. These include
xcodebuildfor building applications,xcrun simctlfor simulator management (boot, install, launch, spawn), and theascCLI for screenshot operations. - [EXTERNAL_DOWNLOADS]: The instructions include
pip install koubou==0.18.1to install a specific version of a framing utility. It also referenceskou setup-frameswhich performs a one-time download of device assets from the tool's backend. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined JSON configuration files (
.asc/shots.settings.jsonand.asc/screenshots.json) to drive automation. While these files are ingested into the workflow, the risk is minimal as they are used to populate command-line arguments and structured plan steps within a local development environment. - [SAFE]: The external source mentioned for feedback (github.com/rorkai/App-Store-Connect-CLI) is the official repository for the toolset described in the skill, representing standard vendor behavior.
Audit Metadata