asc-builds-archive
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands including
asc,xcodebuild, andjqto automate the Xcode build, archive, and upload process. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project configuration files (
.asc/project.json) and auto-detects Xcode workspace/project files. This data is used to populate command arguments, representing a potential surface for injection if project files are sourced from untrusted parties. - Ingestion points:
.asc/project.json(SKILL.md),*.xcworkspaceand*.xcodeproj(references/workflow.md). - Boundary markers: None specified in the instructions.
- Capability inventory: Execution of
ascandxcodebuildvia shell. - Sanitization: Not explicitly defined in the skill markdown; implementation resides in the underlying CLI tool.
- [DYNAMIC_EXECUTION]: The workflow involves generating a temporary
ExportOptions.plistfile at runtime which is then passed to thexcodebuildprocess for code signing and export configuration.
Audit Metadata