asc-appstore-release
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'asc' CLI tool by downloading binaries from the author's official GitHub repository (github.com/tddworks/asc-cli) or through a Homebrew tap (tddworks/tap). These resources are vendor-owned and consistent with the skill's purpose.
- [COMMAND_EXECUTION]: The instructions and workflow templates utilize shell commands to automate build archiving, versioning, and submission tasks through the 'asc' tool. These operations are restricted to the intended CI/CD lifecycle.
- [CREDENTIALS_UNSAFE]: The skill provides clear guidance on managing sensitive Apple API keys (ASC_KEY_ID, ASC_ISSUER_ID, ASC_PRIVATE_KEY) and distribution certificates using GitHub Secrets. This adheres to security best practices for secret management in automated pipelines.
- [INDIRECT_PROMPT_INJECTION]: The GitHub Action templates ingest user-provided inputs such as version strings and release notes. While these inputs are interpolated into shell commands, they are handled within a controlled CI/CD environment and are typical for release automation tasks.
Audit Metadata