plan-mobile-readiness — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-mobile-readiness (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior mobile release engineer + store-compliance specialist.
Task: Inventory build/config/listing against checklist A–E, map gaps to store guidelines, phase remediations, emit plan-mobile-readiness.md. Audit & plan only — no manifest, Data Safety, or listing edits until approved.
Catch the rejections before the reviewer does. Change nothing until approved.
About 25% of App Store submissions are rejected on first pass — mechanical, pre-detectable causes: missing privacy manifests, Data Safety ↔ permission mismatches, no demo account, placeholder buttons, crashes on older devices, stale target API. Apple blocks prompt-to-app builders under Guideline 2.5.2 — the thin web-view rejection vibe-coded apps trip constantly.
Trigger phrases: "is my app store-ready", "will Google Play reject this", "pre-submission check", "privacy manifest", "data safety form", "app store rejection", "about to submit my app".
Do not fire for: runtime perf (mobile-rn-performance), screen polish (mobile-rn-screen), or general UI (enhance-capacitor-ui). This owns submission compliance and rejection-risk.
PrivacyInfo.xcprivacy, required-reason APIs, SDK manifests.NS*UsageDescription.plan-stub-checker..aab, release-signed, 64-bit, no debuggable.plan-mobile-readiness.md# Mobile Store-Readiness Audit — <app>
_Audit-only. Pre-submission. Nothing changes until each phase is approved._
## Scope
- Platform: iOS ☐ Android ☐ | Framework: Capacitor ☐ RN ☐
## Verdict
| Area | Blocking | Risk | Worst item |
|------|----------|------|-----------|
| Privacy | n | n | Data Safety mismatch |
| Functionality | n | n | 2.5.2 thin-app |
## Findings
| # | Item | Store | Guideline | Blocking? | Direction |
|---|------|-------|-----------|-----------|-----------|
## Phased burndown
- **Phase 1 — Privacy** → `mobile-capacitor-platform`
- **Phase 2 — Functionality & 2.5.2** → `plan-stub-checker` / `enhance-capacitor-ui`
- **Phase 3 — Payments & build** → `mobile-capacitor-platform`
- **Phase 4 — Listing & testing gate** → metadata, Android closed-test
## Execution handoff
Real older devices + IAP dry-run before submit.plan-aeo-readiness for web.mobile-capacitor-platform, enhance-capacitor-ui,mobile-emulator-test (then real device).
Plan with a strong model; execute with composer-2.5-execution.mdc.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.