asc-beta-review
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: The skill documents standard management of App Store Connect beta reviews using the 'asc' CLI tool, with no malicious patterns detected.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection by reading local configuration files, though this is considered safe practice for this utility.
- Ingestion points: The 'Typical Workflow' and 'Resolve App ID' sections read metadata from the
.asc/project.jsonfile. - Boundary markers: None; the skill assumes the local project environment is trusted.
- Capability inventory: The skill executes shell commands (
asc,jq,cat) using values derived from the ingested configuration. - Sanitization: Data is extracted using
jq, which ensures the input is valid JSON and specifically selects the targeted keys. - [CREDENTIALS_UNSAFE]: The skill promotes secure credential management by instructing users to reference their private key path (
~/.asc/AuthKey.p8) rather than hardcoding API keys or secrets directly in the instructions.
Audit Metadata