Is ios-app-store-connect safe to install?

SaferSkills independently audited ios-app-store-connect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.cursor/skills/ios-app-store-connect/SKILL.md · 1 file

.cursor/skills/ios-app-store-connect/SKILL.md6.1 KB · Markdown

name: ios-app-store-connect

description: Ship iOS apps with the App Store Connect CLI (asc)—TestFlight, IPA upload, metadata, signing, and App Store submission. Use when distributing builds, managing TestFlight, submitting for review, or automating release pipelines from the agent loop.

iOS App Store Connect

Overview

Use [asc](https://github.com/rorkai/App-Store-Connect-CLI) (asc) for distribution. Keep simulator development on XcodeBuildMCP (ios-debugger-agent); switch to asc when the task is archive, upload, TestFlight, metadata, signing, or App Store submission.

Read references as needed:

references/auth-setup.md — API keys, profiles, CI/Agent env vars
references/testflight-workflow.md — local Xcode → TestFlight (.asc/workflow.json)
references/app-store-release.md — validate, stage, publish, monitor review
references/upstream-skills.md — optional granular skills from app-store-connect-cli-skills

Copy templates from templates/ into the iOS project root as .asc/ (adjust paths, team ID, bundle ID, app ID).

Prerequisites

Xcode (full app) for archive/export—not Command Line Tools alone.
`asc` installed:

   brew install asc
   # or: curl -fsSL https://asccli.sh/install | bash
   asc version

App Store Connect API key (.p8) with appropriate role (Developer or Admin for releases).
App record in App Store Connect (bundle ID, app ID).

Safety (always)

Never commit .p8 keys, .asc/config.json with credentials, or exported .ipa / .xcarchive unless the repo is explicitly set up for that.
Prefer `--dry-run` and `asc workflow validate` before mutating releases.
Require explicit user confirmation before `--submit --confirm`, metadata apply, or destructive cleanup.
Use `--output json` (or rely on pipe default) when parsing results in the agent loop.
If keychain access fails in Agent terminals, set ASC_BYPASS_KEYCHAIN=1 or use asc auth login --bypass-keychain (see auth reference).

Core workflow

1) Verify tooling and auth

asc version
asc auth status --validate
asc auth doctor
asc apps list --output json

If auth is missing, follow references/auth-setup.md and stop until the user completes login.

2) Resolve identifiers

Collect before upload/submit:

ID	How
App Store Connect app ID	`asc apps list --output json`
Bundle ID	Xcode target or `asc bundle-ids list`
Team ID	Apple Developer membership or export options
Scheme / project	`xcodebuild -list` or repo docs
TestFlight group name or ID	`asc testflight groups list --app APP_ID`

3) Choose the shipping path

Goal	Canonical command
Upload IPA only	`asc builds upload --app APP_ID --ipa PATH.ipa`
TestFlight (upload + group + wait)	`asc publish testflight --app APP_ID --ipa PATH.ipa --group GROUP --wait`
External TF beta review	add `--submit --confirm` to `publish testflight`
App Store release	`asc publish appstore --app APP_ID --ipa PATH.ipa --version VERSION --submit --confirm`
Readiness check	`asc validate --app APP_ID --version VERSION`
Review blockers	`asc review doctor --app APP_ID`

For local Xcode → IPA → TestFlight in one repo-local pipeline, prefer .asc/workflow.json (see references/testflight-workflow.md).

4) Build the release artifact

Option A — `asc` xcode commands (recommended for release automation)

asc builds next-build-number --app APP_ID --version VERSION --platform IOS --output json
asc xcode inject --manifest .asc/deployment.json --set version=... --set build_number=... --overwrite
asc xcode archive --project ... --scheme ... --configuration Release ...
asc xcode export --archive-path ... --export-options .asc/export-options-app-store.plist --ipa-path ...

Option B — existing IPA

Skip archive/export; use asc publish testflight or asc builds upload with the given path.

Do not use XcodeBuildMCP simulator build tools for App Store IPA export—they target Simulator/debug loops, not distribution archives.

5) Validate before submit

asc validate --app APP_ID --version VERSION --output json
asc review doctor --app APP_ID --output json

Summarize blockers as: API-fixable (metadata, encryption, export compliance), web-only (first-time privacy, IAP setup), manual (contracts, banking). Propose the next single asc command for each fixable item.

6) Publish and monitor

# TestFlight
asc publish testflight --app APP_ID --ipa ./path.ipa --group "Internal Testers" --wait --output json

# App Store (after user confirms)
asc publish appstore --app APP_ID --ipa ./path.ipa --version VERSION --submit --confirm --output json
asc status --app APP_ID --watch
asc review status --app APP_ID --output json

Report: build number, build ID, processing state, group assignment, submission state.

Agent handoff from development

Typical end-to-end prompt shape:

Develop — ios-debugger-agent: build/run on Simulator, UI checks.
Release — this skill: archive → export → asc publish testflight or appstore.
Metadata (if needed) — asc metadata init/apply or install upstream asc-metadata-sync (see upstream reference).

Troubleshooting

Symptom	Action
Auth fails in Agent terminal	`ASC_BYPASS_KEYCHAIN=1`, re-login with `--bypass-keychain`, see auth reference
Upload rejected (version)	Marketing version must be new if current version is already `READY_FOR_DISTRIBUTION`
Export/signing errors	`asc auth doctor`; add `-allowProvisioningUpdates` via `asc xcode archive/export` flags
Build stuck processing	`asc builds list --app APP_ID`; increase wait/`--poll-interval` on publish
"Can I submit?"	`asc validate` + `asc review doctor`; prefer upstream `asc-release-flow` patterns

Optional: full upstream skill pack

For metadata sync, signing setup, ASO, subscriptions, and Apple Ads, install the community skill pack (see references/upstream-skills.md). This skill stays the default entry point for Cursor distribution workflows.

ios-app-store-connect— agent skill

Is ios-app-store-connect safe to install?

iOS App Store Connect

Overview

Prerequisites

Safety (always)

Core workflow

1) Verify tooling and auth

2) Resolve identifiers

3) Choose the shipping path

4) Build the release artifact

5) Validate before submit

6) Publish and monitor

Agent handoff from development

Troubleshooting

Optional: full upstream skill pack

Audit the pieces. Scan the whole. Decide.