The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing the asc CLI tool from a third-party Homebrew tap (tddworks/tap/asccli). This involves downloading and installing external software maintained by the skill author.
[COMMAND_EXECUTION]: The primary function of the skill is to execute shell commands via the asc CLI, which allows for broad interaction with the local environment and App Store Connect resources.
[CREDENTIALS_UNSAFE]: The documentation provides examples for handling sensitive authentication artifacts, specifically Apple App Store Connect API keys and private key files located at ~/.asc/AuthKey_XXXXXX.p8.
[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to follow the affordances field in JSON responses from the CLI tool rather than constructing commands manually. This creates a vulnerability surface where potentially malicious data returned from the App Store Connect API could influence the agent's actions.
Ingestion points: Data is ingested from the JSON output of asc CLI commands in SKILL.md.
Boundary markers: None are present to distinguish between trusted instructions and data-driven command suggestions.
Capability inventory: The skill has the capability to execute various shell commands through the asc tool.
Sanitization: There is no evidence of sanitization or validation performed on the command strings provided in the affordances field before execution.

asc-cli