The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands through the asc CLI tool and jq to manage TestFlight resources and parse project configuration files (e.g., .asc/project.json). These are standard operations for the tool's intended use case.
[DATA_EXFILTRATION]: The skill accesses a sensitive App Store Connect private key at ~/.asc/AuthKey.p8 for authentication. While this is a sensitive file path, it is the standard location and required credential for Apple's API authentication in this context.
[PROMPT_INJECTION]: The skill processes untrusted external data through the asc testflight testers import command which reads from testers.csv. This represents an indirect prompt injection surface.
Ingestion points: Untrusted data enters the context via the testers.csv file referenced in SKILL.md and references/commands.md.
Boundary markers: None identified; there are no explicit instructions to the agent to ignore or delimit instructions found within the CSV data.
Capability inventory: The skill has the capability to execute shell commands (asc, jq, cat) and write to the file system (redirecting output to testers.csv).
Sanitization: No sanitization or validation logic is defined for the CSV content within the skill instructions.

asc-testflight