asc-experiments
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute the
ascCLI tool to interact with the App Store Connect API. It provides workflows using standard shell utilities likecatandjqto parse project configuration and command outputs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project configuration files (
.asc/project.json) and uses the output of theascCLI to drive subsequent actions. - Ingestion points:
.asc/project.jsoninSKILL.md. - Boundary markers: Not explicitly defined in the provided workflow.
- Capability inventory: Subprocess execution of the
ascCLI and standard Unix utilities (cat,jq) across theSKILL.mdworkflows. - Sanitization: Not explicitly present in the instructional examples.
Audit Metadata