asc-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation for a CLI tool (
asc) intended for App Store Connect automation tasks. No malicious patterns, exfiltration, or obfuscation were detected. - [COMMAND_EXECUTION]: The skill's primary function is to facilitate the execution of shell commands through
asc workflow run. These commands are defined in a local.asc/workflow.jsonfile. This is standard behavior for an automation engine. - [INDIRECT_PROMPT_INJECTION]: The skill processes repository-local data via the
.asc/workflow.jsonconfiguration file. While this represents a potential surface for injection, the instructions include a 'Safety rules' section that explicitly directs users to treat the configuration file as code and only execute trusted workflows, providing a manual verification step for safety. (Ingestion: .asc/workflow.json; Boundary: Safety rules section warning; Capability: execution of shell commands; Sanitization: relies on user trust and manual verification of config content).
Audit Metadata