asc-metadata-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited asc-metadata-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to keep App Store metadata in sync with App Store Connect. Prefer the canonical asc metadata workflow for app-info and version localization fields. Use the lower-level asc localizations and asc migrate commands only when the user specifically needs .strings files or legacy fastlane-format metadata.
asc metadata pull --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"If the app has multiple app-info records, resolve the app-info ID first and pass it explicitly:
asc apps info list --app "APP_ID" --output table
asc metadata pull --app "APP_ID" --app-info "APP_INFO_ID" --version "1.2.3" --platform IOS --dir "./metadata"Canonical files are written under:
metadata/app-info/<locale>.json for app-level fields: name, subtitle, privacyPolicyUrl, privacyChoicesUrl, privacyPolicyTextmetadata/version/<version>/<locale>.json for version fields: description, keywords, marketingUrl, promotionalText, supportUrl, whatsNewCopyright is not a localization field. Manage it with:
asc versions update --version-id "VERSION_ID" --copyright "2026 Your Company"asc metadata validate --dir "./metadata" --output tableFor subscription apps, include the extra Terms of Use / EULA heuristic:
asc metadata validate --dir "./metadata" --subscription-app --output tableRun a dry run first:
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --dry-run --output tableApply after the plan looks correct:
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"Use asc metadata apply when the user wants the apply-named command shape for the same canonical files:
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --dry-run
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"Use this when only the version-localization keywords field should change:
asc metadata keywords diff --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"
asc metadata keywords apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --confirmFor importing keyword research:
asc metadata keywords import --dir "./metadata" --version "1.2.3" --locale "en-US" --input "./keywords.csv"
asc metadata keywords sync --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --input "./keywords.csv"For one-off version-localization edits, pass an explicit version selector. Use --version-id for deterministic updates when you already have it, or --version plus --platform when working from a version string.
asc apps info edit --app "APP_ID" --version-id "VERSION_ID" --locale "en-US" --whats-new "Bug fixes and improvements"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --description "Your app description here"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --keywords "keyword1,keyword2,keyword3"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --support-url "https://support.example.com"For app-info fields, prefer the post-create setup command:
asc app-setup info set --app "APP_ID" --primary-locale "en-US" --privacy-policy-url "https://example.com/privacy"
asc app-setup info set --app "APP_ID" --locale "en-US" --name "Your App Name" --subtitle "Your subtitle"Use .strings files when the user specifically wants import/export files instead of canonical JSON:
asc localizations list --version "VERSION_ID" --output table
asc localizations download --version "VERSION_ID" --path "./localizations"
asc localizations upload --version "VERSION_ID" --path "./localizations" --dry-run
asc localizations upload --version "VERSION_ID" --path "./localizations"For app-info localizations:
asc apps info list --app "APP_ID" --output table
asc localizations list --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --output table
asc localizations download --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --path "./app-info-localizations"
asc localizations upload --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --path "./app-info-localizations" --dry-run
asc localizations upload --app "APP_ID" --type app-info --app-info "APP_INFO_ID" --path "./app-info-localizations"Use this only for existing fastlane-format trees:
asc migrate export --app "APP_ID" --version-id "VERSION_ID" --output-dir "./fastlane"
asc migrate validate --fastlane-dir "./fastlane"
asc migrate import --app "APP_ID" --version-id "VERSION_ID" --fastlane-dir "./fastlane" --dry-run
asc migrate import --app "APP_ID" --version-id "VERSION_ID" --fastlane-dir "./fastlane"| Field | Limit |
|---|---|
| Name | 30 |
| Subtitle | 30 |
| Keywords | 100 comma-separated characters |
| Description | 4000 |
| What's New | 4000 |
| Promotional Text | 170 |
asc metadata pull unless the user specifically asks for .strings or fastlane metadata.asc metadata validate before remote writes.--dry-run when the command supports it.--version-id or --version plus --platform; do not rely on ambiguous latest-version behavior.--output table for human verification and JSON for automation.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.