asc-app-clips
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the use of the
ascCLI tool for managing App Store Connect services. - [CREDENTIALS_UNSAFE]: The documentation references the standard private key location at
~/.asc/AuthKey.p8for authentication. This is standard practice for the tool's flow and does not represent a credential leak in this context. - [INDIRECT_PROMPT_INJECTION]: The skill processes output from the
ascCLI tool to dynamically construct parameters for subsequent commands. This represents a vulnerability surface where external service responses could influence agent logic. * Ingestion points: Command output fromasclist commands. * Boundary markers: None present. * Capability inventory: Listing, creating, and deleting App Clips, experiences, and localizations. * Sanitization: None described. - [DYNAMIC_EXECUTION]: The skill utilizes shell variables and command substitution to manage resource identifiers during workflows.
Audit Metadata