asc-release-flow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited asc-release-flow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the question is "Can my app be submitted now?" or when the user wants to prepare and submit an App Store version with the current asc command surface.
APP_ID, version string, VERSION_ID when needed, and BUILD_ID up front.asc auth login or ASC_* environment variables../metadata when using metadata-driven staging.asc web ... commands as optional experimental escape hatches for flows not covered by the public API.Blockers usually fall into:
Use asc validate; the old submit-preflight shortcut is not part of the current CLI.
asc validate --app "APP_ID" --version "1.2.3" --platform IOS --output tableUse strict mode when warnings should block automation:
asc validate --app "APP_ID" --version "1.2.3" --platform IOS --strict --output tableFor apps selling digital goods, run the product readiness checks too:
asc validate iap --app "APP_ID" --output table
asc validate subscriptions --app "APP_ID" --output tableUse asc release stage when the user wants to prepare the version, apply/copy metadata, attach the build, and validate, while stopping before review submission.
asc release stage \
--app "APP_ID" \
--version "1.2.3" \
--build "BUILD_ID" \
--metadata-dir "./metadata/version/1.2.3" \
--dry-run \
--output tableApply the staging mutations after the plan looks correct:
asc release stage \
--app "APP_ID" \
--version "1.2.3" \
--build "BUILD_ID" \
--metadata-dir "./metadata/version/1.2.3" \
--confirmUse --copy-metadata-from "1.2.2" instead of --metadata-dir when carrying metadata forward from an existing version.
Use asc review submit for explicit App Store review submission. It wraps build attachment plus review submission creation.
asc review submit --app "APP_ID" --version "1.2.3" --build "BUILD_ID" --dry-run --output table
asc review submit --app "APP_ID" --version "1.2.3" --build "BUILD_ID" --confirmUse --version-id "VERSION_ID" instead of --version when you already resolved the exact version ID.
Use asc publish appstore when upload/build/local-build and submission should be one high-level flow.
asc publish appstore --app "APP_ID" --ipa "./App.ipa" --version "1.2.3" --submit --dry-run --output table
asc publish appstore --app "APP_ID" --ipa "./App.ipa" --version "1.2.3" --submit --confirmAdd --wait when the command should wait for build processing before attaching/submitting.
asc status --app "APP_ID"
asc submit status --version-id "VERSION_ID"
asc submit status --id "SUBMISSION_ID"
asc submit cancel --id "SUBMISSION_ID" --confirmSymptoms:
asc pricing availability view --app "APP_ID" reports no availability.asc pricing availability edit ... cannot update because there is no existing availability record.Check:
asc pricing availability view --app "APP_ID"Bootstrap the first availability record with the experimental web-session flow:
asc web apps availability create \
--app "APP_ID" \
--territory "USA,GBR" \
--available-in-new-territories trueAfter bootstrap, use the public API for ongoing changes:
asc pricing availability edit \
--app "APP_ID" \
--territory "USA,GBR" \
--available true \
--available-in-new-territories trueCheck subscription readiness first:
asc validate subscriptions --app "APP_ID" --output tableIf diagnostics report missing metadata, fix those prerequisites before attaching. Common misses are broad pricing coverage, review screenshots, promotional images, and app/build evidence.
List first-review subscription state:
asc web review subscriptions list --app "APP_ID"Attach a group for first review:
asc web review subscriptions attach-group \
--app "APP_ID" \
--group-id "GROUP_ID" \
--confirmAttach one subscription instead:
asc web review subscriptions attach \
--app "APP_ID" \
--subscription-id "SUB_ID" \
--confirmFor later reviews, submit subscriptions through the public review path:
asc subscriptions review submit --subscription-id "SUB_ID" --confirmasc validate iap --app "APP_ID" --output tableUpload missing review screenshots:
asc iap review-screenshots create --iap-id "IAP_ID" --file "./review.png"For IAPs on a published app:
asc iap submit --iap-id "IAP_ID" --confirmFor the first IAP on an app, or the first time adding a new IAP type, Apple may require selecting the IAP from the app version's "In-App Purchases and Subscriptions" section before submitting the app version. Prepare the IAP with localization, pricing, and review screenshot data first.
For non-renewing IAPs that must be attached to the next app version review, the public API may reject the review item path. The CLI exposes an experimental web-session escape hatch that mirrors the App Store Connect web flow:
asc web review iaps attach --app "APP_ID" --iap-id "IAP_ID" --confirmUse this only for the web-only first-version selection gap, and call out that it uses unofficial Apple web-session endpoints.
asc game-center app-versions list --app "APP_ID"
asc game-center app-versions create --app-store-version-id "VERSION_ID"If Game Center component versions must ship with the app version, use the explicit review-submission API so all items can be added before submission:
asc review submissions-create --app "APP_ID" --platform IOS
asc review items-add --submission "SUBMISSION_ID" --item-type appStoreVersions --item-id "VERSION_ID"
asc review items-add --submission "SUBMISSION_ID" --item-type gameCenterLeaderboardVersions --item-id "GC_LEADERBOARD_VERSION_ID"
asc review submissions-submit --id "SUBMISSION_ID" --confirmasc review items-add also supports gameCenterAchievementVersions, gameCenterActivityVersions, gameCenterChallengeVersions, and gameCenterLeaderboardSetVersions.
The public API can surface privacy advisories, but it cannot fully verify App Privacy publish state.
asc web privacy pull --app "APP_ID" --out "./privacy.json"
asc web privacy plan --app "APP_ID" --file "./privacy.json"
asc web privacy apply --app "APP_ID" --file "./privacy.json"
asc web privacy publish --app "APP_ID" --confirmIf the user avoids experimental web-session commands, confirm App Privacy manually in App Store Connect:
https://appstoreconnect.apple.com/apps/APP_ID/appPrivacyasc review details-for-version --version-id "VERSION_ID"Create or update details:
asc review details-create \
--version-id "VERSION_ID" \
--contact-first-name "Dev" \
--contact-last-name "Support" \
--contact-email "[email protected]" \
--contact-phone "+1 555 0100" \
--notes "Explain the reviewer access path here."
asc review details-update \
--id "DETAIL_ID" \
--notes "Updated reviewer instructions."Only set demo-account fields when App Review truly needs demo credentials.
An app is effectively ready when:
asc validate --app "APP_ID" --version "VERSION" --platform IOS has no blocking issues.asc release stage --dry-run produces the expected plan, or asc release stage --confirm has successfully prepared the target version.VALID and attached to the target version.asc validate for readiness.asc release stage for pre-submit preparation.asc review submit for explicit App Store review submission.asc publish appstore --submit --confirm for high-level upload plus submission.asc status and asc submit status after submission.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.