ppp-rebalance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ppp-rebalance (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are helping the user rebalance their iOS app's subscription prices across App Store territories using a Purchasing Power Parity index. The appstoreconnect-mcp server is connected and provides the necessary tools.
The MCP does the math for you — ppp_compute_proposal is the single tool that produces the dry-run table. Your job is to drive the conversation, validate the proposal with the user, and apply it via the write tools.
Run these phases in order. Never skip the dry-run.
If the user hasn't named the app + subscription:
asc_list_apps — find the app (filter by bundle ID if known).asc_list_subscription_groups for that app.asc_list_subscriptions for the relevant group.$29.99 USD).ppp_compute_proposal(
subscriptionId: "...",
basePriceAnchor: 29.99,
anchorTerritory: "USA",
roundStrategy: "nearest" // or "down" / "up"
)The tool:
ppp_load_index shows the snapshot).floorFactor) so a bad index entry can't crash the price.Show the table to the user. Stop and wait for explicit approval before any writes.
If the user wants to tweak:
roundStrategy: "down" (more conservative for emerging markets) or "up" (more revenue-protective).territories: ["BRA", "MEX", "ARG", "TUR", "IND", "IDN"] to scope the proposal.basePriceAnchor.skipUnchanged: false.skipMissingIndex: false so the user can see which territories Apple Music data is missing for.Use the single-tool flow whenever possible:
ppp_apply_proposal(
subscriptionId: "...",
basePriceAnchor: 29.99,
anchorTerritory: "USA",
roundStrategy: "down",
// Optional. Defaults shown.
// startDate: "<YYYY-MM-DD>", // default: today + 7 days
// preserveCurrentPrice: true,
// floorFactor: 0.15, // hard lower bound vs current local price; 0.30 is more conservative
// maxConcurrency: 2,
// maxDropPct: 90,
)What it does:
maxDropPct (default 90%) — guards against bad index data.maxConcurrency (default 2). The HTTP client transparently retries on Apple's 429 rate limits with exponential backoff.currency-mismatch); set those manually if you want to.If the client doesn't support elicitation, the tool returns the proposal and instructs the caller to re-run with confirm: true.
If you specifically need per-row control (debugging, partial apply, etc.), call asc_post_subscription_price for each row from the proposal:
asc_post_subscription_price(
subscriptionId: "...",
territoryId: "<3-letter code>",
pricePointId: "<POINT_ID from proposal>",
startDate: "<YYYY-MM-DD>",
preserveCurrentPrice: true
)preserveCurrentPrice: true unless the user explicitly says otherwise — grandfathers existing subscribers.NOTE (no-index, no-current-price, no-price-points, snap-failed, unchanged).After the apply, re-run asc_list_subscription_prices and confirm the pending schedule matches the proposal. The new entries will have a non-null START_DATE.
If the proposal turns out wrong before activation:
asc_list_subscription_prices — find the pending entries (future startDate).asc_delete_subscription_price with the PRICE_ID.asc_list_subscription_prices to confirm the schedule is clean.These have bitten people doing this before; cite them when relevant:
RUS.currency-mismatch (asc=USD, am=BHD) etc. and skip them from the apply set. This is intentional — multiplying a USD anchor by a (BHD/USD) ratio and writing the result back as USD is dimensionally wrong, so the formula doesn't apply. If you want to set prices for those markets, do it manually via asc_post_subscription_price after deciding on a number outside the PPP formula.roundStrategy: "down".data/apple-music-prices.json is refreshed manually upstream. Show the snapshot date when presenting the proposal so the user can decide whether to refresh it first.asc_post_subscription_price directly without PPP factors; the initial schedule is a one-shot decision.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.