asc-iap

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No security issues were detected. The skill follows standard patterns for an AI agent interacting with a CLI tool for business operations.
  • [COMMAND_EXECUTION]: The skill defines various bash commands for interacting with the asc CLI tool to manage In-App Purchases, pricing, localizations, and offer codes. These commands are consistent with the skill's stated purpose of managing App Store Connect resources.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files and CLI tool outputs.
  • Ingestion points: .asc/project.json and output from asc commands in SKILL.md.
  • Boundary markers: None present.
  • Capability inventory: Executes shell commands via the asc CLI, reads files with cat/jq, and writes to files via redirection.
  • Sanitization: No explicit sanitization of tool output is described.
  • The associated risk is considered safe as these inputs originate from the local project environment or the official API service.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:19 AM