The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the asc CLI tool to perform operations on App Store Connect. This includes registering bundle IDs (asc bundle-ids create), creating app records (asc iris apps create), updating metadata (asc app-infos update, asc version-localizations update), managing builds (asc builds archive, asc builds upload), and submitting for review (asc versions submit).
[INDIRECT_PROMPT_INJECTION]: The skill accepts various user-provided inputs that are subsequently passed to shell commands, creating a potential surface for prompt injection or command manipulation.
Ingestion points: User-provided app names, descriptions, keywords, support URLs, marketing URLs, and privacy policy URLs are processed in SKILL.md (Steps 1.1, 2.2, 2.3, 3.3).
Boundary markers: The skill instructions use standard shell quoting (e.g., --description "<DESCRIPTION>") but do not include explicit instructions to the agent to ignore potentially malicious instructions embedded in that content.
Capability inventory: The skill leverages the asc CLI which has capabilities for network operations (App Store Connect API), local file archiving, and remote file uploads.
Sanitization: There is no evidence of explicit input validation, filtering, or sanitization of the user-provided strings before they are interpolated into the shell command templates.

asc-new-app-release