The Agent Skills Directory

[SAFE]: The skill performs legitimate project initialization tasks. It manages developer contact information and App Store Connect metadata locally within the project's .asc/ directory, aligning with standard development practices for the asc CLI tool.
[INDIRECT_PROMPT_INJECTION]: The skill includes functionality to auto-detect bundle identifiers from local Xcode project files, which introduces a data ingestion surface. However, the logic is restricted to literal string matching, which mitigates the risk of processing malicious inputs.
Ingestion points: The skill scans *.xcodeproj/project.pbxproj files in the current directory (SKILL.md).
Boundary markers: No specific boundary markers or 'ignore' instructions are present in the skill body.
Capability inventory: The skill uses the asc CLI, shell execution for variable assignment, and jq for parsing; it writes metadata to the local filesystem.
Sanitization: The auto-detection logic explicitly filters for literal PRODUCT_BUNDLE_IDENTIFIER values and skips variable references like $(PRODUCT_BUNDLE_IDENTIFIER), providing a basic safeguard against complex injection patterns within the project files.

asc-init