asc-revenuecat-catalog-sync
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
ascCLI commands to manage App Store Connect subscriptions and in-app purchases. Security is maintained through a mandatory audit-first workflow and requiring explicit user approval before any resource creation or modification. - [EXTERNAL_DOWNLOADS]: The skill references official documentation and resources for RevenueCat at
revenuecat.com. These are recognized as legitimate resources from a well-known service for the skill's integration tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from external store catalogs, which represents a surface for indirect prompt injection.
- Ingestion points: Catalog data is retrieved from App Store Connect and RevenueCat APIs via CLI output and MCP tools (SKILL.md).
- Boundary markers: The agent must present a reconciliation plan and obtain manual approval before proceeding with changes.
- Capability inventory: The skill possesses the capability to execute shell commands (
asc) and write data to the local filesystem in the./auditdirectory (SKILL.md). - Sanitization: The skill relies on structured JSON data processing and requires the use of the
asc validateutility to verify catalog integrity before mapping resources.
Audit Metadata