app-clips — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited app-clips (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build lightweight, instantly available versions of an iOS app for focused in-the-moment experiences or demos.
An App Clip is a separate target in the same Xcode project as your full app:
com.example.MyApp.Clip.com.apple.developer.on-demand-install-capablecom.apple.developer.parent-application-identifierscom.apple.developer.associated-appclip-app-identifiersUse Swift packages or shared source files for code needed by both targets. Add App Clip-specific compile branches with the APPCLIP active compilation condition, and avoid linking full-app-only frameworks into the App Clip target.
Validation checkpoint: Archive both targets and inspect their archived entitlements. If signing or validation fails, correct the three raw key/target assignments above and rearchive until both pass.
Read references/routing-and-experiences.md when implementing invocation URL routing, App Store Connect experiences, Local Experiences, Safari Smart App Banners, QR/NFC/App Clip Codes, AASA, or associated domains.
App Clips receive NSUserActivityTypeBrowsingWeb activities. Keep the invocation router shared with the full app because, after installation, the full app replaces the App Clip and receives future invocations.
.onContinueUserActivity(NSUserActivityTypeBrowsingWeb).connectionOptions.userActivities in scene(_:willConnectTo:options:).NSUserActivity in scene(_:continue:).scene(_:willContinueUserActivityWithType:) is only advance notice and does not provide the URL.Configure the required default App Clip experience in App Store Connect. Use advanced experiences for Maps integration, location association, production App Clip Codes, per-location cards, and precise physical-place routing; demo App Clip Codes can use the short demo App Clip link.
For custom URLs, add appclips:example.com to Associated Domains on both the full app and App Clip targets, and host an AASA file with the App Clip app identifier. For Safari banners, use app-id, app-clip-bundle-id, and optional app-clip-display=card; do not rely on app-argument for App Clip launches.
Validation checkpoint: Exercise each URL with _XCAppClipURL and a Local Experience, fix routing/AASA/experience mismatches, and repeat until the App Clip and installed full app reach the same destination.
Use Size, capabilities, and promotion as the authoritative checklist for feasibility reviews, size tiers and measurement, Background Assets, CloudKit, Live Activities, unsupported features, and full-app promotion. Load it whenever any of those topics is in scope.
Keep product reviews at the boundary level: state the size basis, invocation and download fit, capability exclusions, and handoff destination. Add implementation APIs only when the user asks for implementation.
Read references/data-handoff-notifications-location.md when implementing App Group/full-app migration, keychain or Sign in with Apple handoff, ephemeral notifications, notification relaunch routing, or physical location confirmation.
Treat App Group storage as non-secret handoff state, not a trust boundary. The reference owns the iOS 15.4+ one-way keychain rule, Sign in with Apple verification, ephemeral-notification permission and relaunch routing, and physical-location confirmation—including their required raw keys and targets.
Choose and measure the applicable limit using Size Limits.
App Clips should let people complete a focused task or full demo without installing the app. Avoid marketing-only clips, ad-heavy flows, splash screens, launch-blocking downloads, repeated install prompts, and web-view-heavy experiences that would work better as a website.
Do not ship until every applicable gate passes; fix failures and rerun the same gate.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.