asc-release-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands using the
ascCLI tool to manage App Store Connect builds and metadata. It also executes commands defined in therelease.ymlconfiguration underpre_archive, such astuist generate, to prepare the project environment before archiving. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of 'What's New' release notes, which are then translated and interpolated into shell commands for metadata updates. While this presents an attack surface where malicious input could attempt to break out of command strings, the instructions use quotes for interpolation, and the risk is assessed as low given the specific context of mobile app publishing workflows.
Audit Metadata