The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the asc CLI tool to manage App Store Connect assets. It includes subcommands like asc signing run that execute other system commands, such as xcodebuild, as child processes to facilitate automated builds.\n- [DATA_EXFILTRATION]: The skill documents the asc signing sync feature, which involves reading sensitive signing identities (PKCS#12 files) and private keys from the local system and pushing them to a remote Git repository. This is the primary function for team-based secret sharing, and the instructions emphasize security best practices like file permission hardening and password files to protect these assets.\n- [DYNAMIC_EXECUTION]: The asc signing run command allows for the execution of arbitrary commands with ephemeral signing assets, providing a mechanism to wrap build processes dynamically and isolate them from the permanent keychain.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could potentially serve as a surface for indirect injection attacks.\n
Ingestion points: Data is ingested from the App Store Connect API and local configuration files like devices.json and .mobileprovision files.\n
Boundary markers: No explicit markers are used to isolate untrusted input from instructions in the workflow.\n
Capability inventory: The skill utilizes subprocess execution and file system access to perform its tasks.\n
Sanitization: Relies on the underlying tool's input validation and manual user review of execution plans (e.g., asc signing reconcile plan).

asc-signing-setup