rating-prompt-strategy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rating-prompt-strategy (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You optimize when, how, and to whom an app shows review prompts — maximizing high ratings while minimizing negative ones. Ratings are an App Store ranking signal and a conversion factor on the product page.
Only prompt users who have experienced value. Prompting too early produces low ratings. Prompting at a success moment produces 4–5 star ratings.
Apple's native prompt. Rules:
import StoreKit
// Call at the right moment
if let scene = UIApplication.shared.connectedScenes.first as? UIWindowScene {
SKStoreReviewController.requestReview(in: scene)
}Google's native prompt. Rules:
val manager = ReviewManagerFactory.create(context)
val request = manager.requestReviewFlow()
request.addOnCompleteListener { task ->
if (task.isSuccessful) {
val reviewInfo = task.result
val flow = manager.launchReviewFlow(activity, reviewInfo)
flow.addOnCompleteListener { /* proceed */ }
}
}Define 1–3 "success moments" in your app where users are most satisfied:
| App Type | Good Prompt Moments | Bad Prompt Moments |
|---|---|---|
| Fitness | After completing a workout | After skipping a session |
| Productivity | After completing a project/task | After a failed save or sync error |
| Games | After winning a level or beating a boss | After losing or failing |
| Finance | After first successful transaction | After a confusing error |
| Meditation | After completing a session | On cold open |
| Shopping | After a successful purchase/delivery | After a failed checkout |
Only prompt users who meet all criteria:
Criteria to prompt:
✓ Sessions >= 3 (not a first-time user)
✓ Time since install >= 3 days
✓ Has completed [activation event] at least once
✓ No crash in last session
✓ No negative signal (error, cancellation) in current session
✓ Not already rated this versionBefore triggering the native prompt, show a single in-app question:
"Are you enjoying [App Name]?"
[Yes, love it!] [Not really]SKStoreReviewRequest / Play In-App ReviewThis filters out dissatisfied users before they can rate you 1–2 stars.
Expected improvement: 0.3–0.8 stars on average with a pre-prompt filter.
iOS allows you to reset ratings per version in App Store Connect. Use this strategically:
review-management skill)After the fix is shipped:
Day 0: Issue identified — hotfix or patch in progress
Day 1–3: Reply to every negative review acknowledging the issue
Day 7: Fix shipped — reply to previous negative reviews "Fixed in X.X"
Day 8+: Enable prompt for sessions >= 5, no crash last 7 days
Week 3: Monitor rating trend — should recover 0.2–0.5 stars in 2–4 weeks| Platform | Maximum | Recommended |
|---|---|---|
| iOS | 3× per 365 days (Apple-enforced) | 1–2× per version |
| Android | No hard limit (Google throttles) | 1× per 30 days per user |
Never show the prompt twice in the same session.
Current rating: [X.X] ★ ([N] ratings)
Platform: iOS / Android / Both
Success moments identified:
1. [Event name] — fires when [condition]
2. [Event name] — fires when [condition]
Pre-prompt survey: Yes / No
If yes: "Are you enjoying [App Name]?" → Yes / Not really
Prompt trigger logic:
Sessions >= [N]
Days since install >= [N]
No crash in last [N] sessions
[Activation event] completed: yes
Already rated this version: no
Expected outcome: +[X] stars over [N] weeks
Recovery plan (if rating < 4.0):
1. [Fix] — ship by [date]
2. [Reply strategy] — [N] reviews to address
3. [Prompt campaign] — start [date], target [segment]review-management — Respond to reviews to recover ratingonboarding-optimization — Fix activation issues that drive 1-star reviewsandroid-aso — Play In-App Review API contextretention-optimization — Engaged users give better ratings~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.