asc-iap
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were detected. The skill follows standard patterns for an AI agent interacting with a CLI tool for business operations.
- [COMMAND_EXECUTION]: The skill defines various bash commands for interacting with the
ascCLI tool to manage In-App Purchases, pricing, localizations, and offer codes. These commands are consistent with the skill's stated purpose of managing App Store Connect resources. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files and CLI tool outputs.
- Ingestion points:
.asc/project.jsonand output fromasccommands inSKILL.md. - Boundary markers: None present.
- Capability inventory: Executes shell commands via the
ascCLI, reads files withcat/jq, and writes to files via redirection. - Sanitization: No explicit sanitization of tool output is described.
- The associated risk is considered safe as these inputs originate from the local project environment or the official API service.
Audit Metadata