asc-release-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands using the asc CLI tool to manage App Store Connect builds and metadata. It also executes commands defined in the release.yml configuration under pre_archive, such as tuist generate, to prepare the project environment before archiving.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of 'What's New' release notes, which are then translated and interpolated into shell commands for metadata updates. While this presents an attack surface where malicious input could attempt to break out of command strings, the instructions use quotes for interpolation, and the risk is assessed as low given the specific context of mobile app publishing workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:19 AM