asc-subscription-localization
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill contains no malicious code, obfuscation, or signs of data exfiltration. It follows best practices for authentication by referencing environment variables or standard login commands rather than hardcoding secrets.
- [COMMAND_EXECUTION]: The skill utilizes the
ascCLI tool to automate App Store Connect tasks. The commands are limited to legitimate operations for managing subscription metadata and are consistent with the skill's stated purpose. - [PROMPT_INJECTION]: A potential surface for indirect prompt injection exists due to the processing of external data from the App Store Connect API.
- Ingestion points: Metadata retrieved from the
asc subscriptions list,asc subscriptions groups list, andasc iap listcommands (SKILL.md). - Boundary markers: None explicitly identified in the instructional body for the processed data.
- Capability inventory: Metadata modification via
asc ... localizations create/update(SKILL.md). - Sanitization: No specific sanitization or escaping of API-provided strings is described in the agent's workflow.
Audit Metadata