app-clips — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited app-clips (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You help plan, implement, and optimize App Clips — lightweight iOS experiences (max 15MB) that users can launch instantly without installing the full app.
App Clips are small, focused pieces of your app that users can use without downloading the full app. They appear in:
| Target | Limit |
|---|---|
| App Clip binary | 15MB max (thinned, downloaded on demand) |
| App itself | No change |
This forces you to ship only the essential experience.
| App Type | App Clip Experience |
|---|---|
| Parking/transit | Pay for parking or buy a ticket |
| Restaurant | View menu, order, or pay |
| Retail | Product preview or loyalty card |
| Fitness | Try a single workout |
| Games | Play a demo level |
| Finance | Calculator or quick quote |
| Events | Ticket purchase or check-in |
| Utilities | Use core feature once |
The key question: What is the minimum experience that demonstrates your app's core value?
App Clips appear in App Store search as a separate card below your full app result — labeled "App Clip" with an "Open" button (not "Get").
ASO implication: The App Clip card inherits your app's title and description metadata. Optimizing your main listing improves App Clip discoverability too.
Each App Clip is triggered by a URL:
https://yourdomain.com/clip/[experience]Configure in App Store Connect → Your App → App Clip Experiences.
Always include a clear upgrade prompt:
// Show SKOverlay after the user gets value from the clip
let config = SKOverlay.AppClipConfiguration(position: .bottom)
let overlay = SKOverlay(configuration: config)
overlay.present(in: windowScene)Show the overlay after the user has experienced value — not immediately.
You can configure multiple App Clip experiences (one per URL pattern):
| Experience | URL | Use Case |
|---|---|---|
| Default | yourdomain.com | General / App Store search |
| Location | yourdomain.com/location/123 | Maps, NFC at specific location |
| Campaign | yourdomain.com/promo/summer | Marketing campaign |
| Feature | yourdomain.com/feature/x | Specific feature demo |
Each experience can have its own:
The card is shown before the App Clip launches:
| Field | Limit | Tips |
|---|---|---|
| Title | 18 chars | Clear action: "Order Coffee" not "App Name" |
| Subtitle | 13 chars | Reinforce the value: "Skip the line" |
| Header image | 3000×2000px | Show the outcome, not the UI |
| Action button | — | Use context-specific text: "Order", "Pay", "Play" |
Track in App Store Connect → App Analytics → App Clips:
| App Clip | Full Install | |
|---|---|---|
| User friction | Very low | Higher |
| Commitment | Low | High |
| Retention | Low (one-time use) | High |
| Conversion from Clip | — | 3–5× higher than cold traffic |
| Best for | Discovery + conversion | Retention + monetization |
Setup:
- [ ] App Clip target added to Xcode project
- [ ] App Clip < 15MB (use size report in Xcode)
- [ ] Associated Domains entitlement configured
- [ ] App Clip experience URLs registered in App Store Connect
UX:
- [ ] Core value delivered within 60 seconds
- [ ] Sign in with Apple or Apple Pay (no custom sign-up)
- [ ] SKOverlay shown post-value (not immediately)
- [ ] Clear data handoff when user installs full app
App Store Connect:
- [ ] Default App Clip experience configured
- [ ] Header image uploaded (3000×2000px)
- [ ] Title ≤ 18 chars, subtitle ≤ 13 chars
- [ ] Additional experiences for locations/campaigns (if applicable)aso-audit — Clip discoverability depends on main app ASOonboarding-optimization — Apply same "value-first" principles to Clip experienceua-campaign — Drive traffic to App Clip URLs in paid campaignsapp-store-featured — App Clips can support featuring eligibility~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.