asc-appstore-release

Warn

Audited by Socket on Sep 23, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/setup-mas-certs.sh

The code implements a legitimate macOS signing-certificate setup workflow. It performs expected network interaction through the configured asc CLI and handles private signing material, but it exposes sensitive credentials by printing the P12 and password and by passing the password on an openssl command line. The script should only be run in a trusted environment, and terminal logs, shell/process visibility, Desktop backups, and GitHub output capture should be controlled.

Confidence: 98%Severity: 52%
Audit Metadata
Analyzed At
Sep 23, 2026, 11:19 AM
Package URL
pkg:socket/skills-sh/tddworks%2Fasc-cli-skills%2Fasc-appstore-release%2F@64378061c086e04c56fe203c41fd87025accda8d8eebe7136cbbf185ee18934b