asc-metadata-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited asc-metadata-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to keep App Store metadata in sync with App Store Connect. Prefer the canonical asc metadata workflow for app-info and version localization fields. Use the lower-level asc localizations and asc migrate commands only when the user specifically needs .strings files or legacy fastlane-format metadata.
asc metadata pull --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"If the app has multiple app-info records, resolve the app-info ID first and pass it explicitly:
asc apps info list --app "APP_ID" --output table
asc metadata pull --app "APP_ID" --app-info "APP_INFO_ID" --version "1.2.3" --platform IOS --dir "./metadata"Canonical files are written under:
metadata/app-info/<locale>.json for app-level fields: name, subtitle, privacyPolicyUrl, privacyChoicesUrl, privacyPolicyTextmetadata/version/<version>/<locale>.json for version fields: description, keywords, marketingUrl, promotionalText, supportUrl, whatsNewCopyright is not a localization field. Manage it with:
asc versions update --version-id "VERSION_ID" --copyright "2026 Your Company"asc metadata validate --dir "./metadata" --output tableFor subscription apps, include the extra Terms of Use / EULA heuristic:
asc metadata validate --dir "./metadata" --subscription-app --output tableRun a dry run first:
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --dry-run --output tableApply after the plan looks correct:
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"Use asc metadata apply when the user wants the apply-named command shape for the same canonical files:
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --dry-run
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"For a review-artifact workflow with explicit approval before mutation, use the metadata review commands introduced in asc 2.6.1:
asc metadata plan --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --review-dir ".asc/metadata/review"
asc metadata approve --review-dir ".asc/metadata/review" --all
asc metadata status --review-dir ".asc/metadata/review" --output table
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --review-dir ".asc/metadata/review" --confirmUse asc metadata approve --key "version:1.2.3:en-US:whatsNew" or --scope app-info,version when the user wants selective approval artifacts before the guarded apply. Version-scoped keys include the App Store version string.
Use this when only the version-localization keywords field should change:
asc metadata keywords diff --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"
asc metadata keywords apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --confirmFor importing keyword research:
asc metadata keywords import --dir "./metadata" --version "1.2.3" --locale "en-US" --input "./keywords.csv"
asc metadata keywords sync --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --input "./keywords.csv"For one-off version-localization edits, pass an explicit version selector. Use --version-id for deterministic updates when you already have it, or --version plus --platform when working from a version string.
asc apps info edit --app "APP_ID" --version-id "VERSION_ID" --locale "en-US" --whats-new "Bug fixes and improvements"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --description "Your app description here"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --keywords "keyword1,keyword2,keyword3"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --support-url "https://support.example.com"For app-info fields, prefer the post-create setup command:
asc app-setup info set --app "APP_ID" --primary-locale "en-US" --privacy-policy-url "https://example.com/privacy"
asc app-setup info set --app "APP_ID" --locale "en-US" --name "Your App Name" --subtitle "Your subtitle"Use .strings files when the user specifically wants import/export files instead of canonical JSON:
asc localizations list --version "VERSION_ID" --output table
asc localizations download --version "VERSION_ID" --path "./localizations"
asc localizations upload --version "VERSION_ID" --path "./localizations" --dry-run
asc localizations upload --version "VERSION_ID" --path "./localizations"For app-info localizations:
asc apps info list --app "APP_ID" --output table
asc localizations list --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --output table
asc localizations download --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --path "./app-info-localizations"
asc localizations upload --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --path "./app-info-localizations" --dry-run
asc localizations upload --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --path "./app-info-localizations"Use this only for existing fastlane-format trees:
asc migrate export --app "APP_ID" --version-id "VERSION_ID" --output-dir "./fastlane"
asc migrate validate --fastlane-dir "./fastlane"
asc migrate import --app "APP_ID" --version-id "VERSION_ID" --fastlane-dir "./fastlane" --dry-run
asc migrate import --app "APP_ID" --version-id "VERSION_ID" --fastlane-dir "./fastlane" --confirmDeliverfile metadata_path and screenshots_path values take precedence and resolve relative to the Deliverfile. With --fastlane-dir "./fastlane", use metadata_path "./metadata" rather than "./fastlane/metadata"; the latter resolves to ./fastlane/fastlane/metadata. Fix stale values in the Deliverfile, or remove them to use the conventional metadata/ and screenshots/ directories.
Paths outside the selected Fastlane directory fail unless the operator explicitly trusts them with --allow-external-metadata or --allow-external-screenshots. Keep those flags off for untrusted imports.
Inspect the validation body as well as the process exit: asc migrate validate can return a report with valid: false and a nonzero errorCount while exiting 0. A confirmed import can print status: "partial" with completed stages and failure details while exiting nonzero, so non-empty stdout does not mean success.
| Field | Limit |
|---|---|
| Name | 30 |
| Subtitle | 30 |
| Keywords | 100 comma-separated characters |
| Description | 4000 |
| What's New | 4000 |
| Promotional Text | 170 |
asc metadata pull unless the user specifically asks for .strings or fastlane metadata.asc metadata validate before remote writes.--dry-run when the command supports it.asc metadata plan plus approve/status when the user wants a durable review artifact before apply.--version-id or --version plus --platform; do not rely on ambiguous latest-version behavior.--output table for human verification and JSON for automation.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.