asc-release-flow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited asc-release-flow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the real question is "Can my app be ready to submit?" and then guide the user through the shortest path to a clean App Store submission, especially for first-time releases.
asc auth login or ASC_* env vars).VERSION_ID, SUBMISSION_ID, DETAIL_ID, GROUP_ID, SUB_ID, IAP_ID, and related resource IDs. Use asc-id-resolver when needed.asc release stage or asc release run.When using this skill, answer readiness questions in this order:
Group blockers like this:
Run this first when the user wants the quickest answer to "can I submit now?":
asc submit preflight --app "APP_ID" --version "1.2.3" --platform IOSThis is the fastest high-signal readiness check and prints fix guidance without mutating anything.
Run this when the user wants the version prepared in App Store Connect but wants a manual checkpoint before creating a review submission:
asc release stage \
--app "APP_ID" \
--version "1.2.3" \
--build "BUILD_ID" \
--metadata-dir "./metadata/version/1.2.3" \
--confirmUse --copy-metadata-from "1.2.2" instead of --metadata-dir when you want to carry metadata forward from an existing version. asc release stage requires exactly one metadata source and stops before submit.
Run this when the user wants one command that approximates the whole release path:
asc release run \
--app "APP_ID" \
--version "1.2.3" \
--build "BUILD_ID" \
--metadata-dir "./metadata/version/1.2.3" \
--dry-run \
--output tableThis is the best single-command rehearsal for:
Add --strict-validate when you want warnings treated as blockers.
Run this when the user needs a fuller version-level checklist than submit preflight:
asc validate --app "APP_ID" --version "1.2.3" --platform IOS --output tablePrefer the version string form here so it stays aligned with asc submit preflight and asc release run. Switch to VERSION_ID only for lower-level commands that explicitly require it.
If the app sells digital goods, also run:
asc validate iap --app "APP_ID" --output table
asc validate subscriptions --app "APP_ID" --output tableIn current asc, asc validate subscriptions expands MISSING_METADATA into per-subscription diagnostics. Use it to pinpoint missing review screenshots, promotional images, pricing or availability coverage, offer readiness, and app/build evidence before you retry submission or attach-group.
When territory coverage is wrong, the newest diagnostics name the exact missing territories instead of only reporting count mismatches. Use --output json --pretty when you want machine-readable diagnostics.
When the dry run looks clean:
asc release run \
--app "APP_ID" \
--version "1.2.3" \
--build "BUILD_ID" \
--metadata-dir "./metadata/version/1.2.3" \
--confirmSymptoms:
asc pricing availability view --app "APP_ID" reports no availabilityasc pricing availability edit ... fails because it only updates existing availabilityCheck:
asc pricing availability view --app "APP_ID"Bootstrap the first availability record with the experimental web-session flow:
asc web apps availability create \
--app "APP_ID" \
--territory "USA,GBR" \
--available-in-new-territories trueAfter bootstrap, use the normal public API command for ongoing updates:
asc pricing availability edit \
--app "APP_ID" \
--territory "USA,GBR" \
--available true \
--available-in-new-territories trueFor apps with subscriptions, check readiness explicitly:
asc validate subscriptions --app "APP_ID" --output tableIf the validator shows MISSING_METADATA, read the row-level diagnostics literally. The newest CLI surfaces missing promotional images, review screenshots, pricing or availability coverage, offer readiness, and app/build evidence in one matrix, which is the quickest way to understand why first-review attach still fails.
List current first-review subscription state:
asc web review subscriptions list --app "APP_ID"If the app is going through its first review and the group needs attaching:
asc web review subscriptions attach-group \
--app "APP_ID" \
--group-id "GROUP_ID" \
--confirmIf attach-group still returns MISSING_METADATA, fix the validator-reported prerequisites first. The most common misses are broad pricing coverage and a subscription promotional image.
For one subscription instead of a whole group:
asc web review subscriptions attach \
--app "APP_ID" \
--subscription-id "SUB_ID" \
--confirmFor later reviews, use the normal submission path:
asc subscriptions review submit --subscription-id "SUB_ID" --confirmIf review artifacts are missing, upload them before submission:
asc subscriptions review screenshots create --subscription-id "SUB_ID" --file "./screenshot.png"
asc subscriptions images create --subscription-id "SUB_ID" --file "./image.png"Also make sure the app’s privacy policy URL is populated when the app sells subscriptions.
For apps with one-time purchases, consumables, or non-consumables, check readiness explicitly:
asc validate iap --app "APP_ID" --output tableIf the IAP is missing its App Review screenshot:
asc iap review-screenshots create --iap-id "IAP_ID" --file "./review.png"For IAPs on a published app, submit them directly:
asc iap submit --iap-id "IAP_ID" --confirmIf this is the first IAP for the app, or the first time adding a new IAP type, Apple requires it to be included with a new app version. Current asc commands can validate and submit published-app IAPs, but there is no equivalent first-review attach flow like the subscription web commands yet. In that case:
asc validate iap, pricing, localization, and review screenshot data firstAlso make sure the app’s privacy policy URL is populated when the app sells IAPs.
If the app uses Game Center, make sure the App Store version is Game Center-enabled:
asc game-center app-versions list --app "APP_ID"
asc game-center app-versions create --app-store-version-id "VERSION_ID"If you are adding Game Center components for the first time, include them in the same submission as the app version. Resolve component version IDs first:
asc game-center achievements v2 versions list --achievement-id "ACH_ID"
asc game-center leaderboards v2 versions list --leaderboard-id "LEADERBOARD_ID"
asc game-center challenges versions list --challenge-id "CHALLENGE_ID"
asc game-center activities versions list --activity-id "ACTIVITY_ID"Then use the review-submission flow so you can add the app version and the Game Center component versions to the same submission:
asc review submissions-create --app "APP_ID" --platform IOS
asc review items-add --submission "SUBMISSION_ID" --item-type appStoreVersions --item-id "VERSION_ID"
asc review items-add --submission "SUBMISSION_ID" --item-type gameCenterLeaderboardVersions --item-id "GC_LEADERBOARD_VERSION_ID"
asc review submissions-submit --id "SUBMISSION_ID" --confirmasc review items-add also supports gameCenterAchievementVersions, gameCenterActivityVersions, gameCenterChallengeVersions, and gameCenterLeaderboardSetVersions.
If Game Center component versions need to ship with the app version, prefer the explicit asc review submissions-* flow over asc release run --confirm, because you need a chance to add all submission items before final submit.
The public API can warn about App Privacy readiness but cannot fully verify publish state.
If asc submit preflight, asc validate, or asc release run surfaces an App Privacy advisory, reconcile it with:
asc web privacy pull --app "APP_ID" --out "./privacy.json"
asc web privacy plan --app "APP_ID" --file "./privacy.json"
asc web privacy apply --app "APP_ID" --file "./privacy.json"
asc web privacy publish --app "APP_ID" --confirmIf the user does not want the experimental web-session flow, confirm App Privacy manually in App Store Connect:
https://appstoreconnect.apple.com/apps/APP_ID/appPrivacyCheck whether the version already has review details:
asc review details-for-version --version-id "VERSION_ID"If needed, create or update them:
asc review details-create \
--version-id "VERSION_ID" \
--contact-first-name "Dev" \
--contact-last-name "Support" \
--contact-email "[email protected]" \
--contact-phone "+1 555 0100" \
--notes "Explain the reviewer access path here."asc review details-update \
--id "DETAIL_ID" \
--notes "Updated reviewer instructions."Only set --demo-account-required=true when App Review truly needs demo credentials.
An app is effectively ready to submit when:
asc submit preflight --app "APP_ID" --version "VERSION" reports no blocking issuesasc validate --app "APP_ID" --version "VERSION" is clean or only contains understood non-blocking warningsasc release stage --confirm successfully prepared the target version when you want a real pre-submit checkpointasc release run ... --dry-run produces the expected planVALID and attached to the target versionasc web privacy ... or manual confirmationUse the lower-level flow only when the user needs explicit control over each step:
asc versions attach-build --version-id "VERSION_ID" --build "BUILD_ID"
asc submit preflight --app "APP_ID" --version "1.2.3" --platform IOS
asc submit create --app "APP_ID" --version "1.2.3" --build "BUILD_ID" --confirm
asc submit status --version-id "VERSION_ID"
# or, if you captured the review submission ID:
asc submit status --id "SUBMISSION_ID"If the submission needs multiple review items, such as Game Center component versions, use the review-submission API directly instead:
asc review submissions-create --app "APP_ID" --platform IOS
asc review items-add --submission "SUBMISSION_ID" --item-type appStoreVersions --item-id "VERSION_ID"
asc review items-add --submission "SUBMISSION_ID" --item-type gameCenterChallengeVersions --item-id "GC_CHALLENGE_VERSION_ID"
asc review submissions-submit --id "SUBMISSION_ID" --confirm--platform MAC_OS, TV_OS, or VISION_OS as needed..pkg separately, then use the same readiness and submission flow.asc publish testflight is still the fastest TestFlight shortcut, but for App Store readiness prefer asc submit preflight, asc release stage, and asc release run.asc release stage --confirm is the safest one-command way to prepare a version without submitting it.asc release run --dry-run is the closest thing to a one-command answer for "will this full release flow work?"asc submit preflight is the fastest first pass.asc validate is the deeper API-side checklist for version readiness.asc validate subscriptions now exposes much richer per-subscription diagnostics for MISSING_METADATA readiness failures.asc web apps availability create flow or App Store Connect itself.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.