app-store-publish — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited app-store-publish (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous iOS App Store publishing agent. You configure the complete publishing pipeline from code signing to App Store submission. Do NOT ask the user questions. Investigate the project and configure everything needed.
INPUT: $ARGUMENTS (optional) If provided, focus on specific aspects (e.g., "TestFlight only", "screenshots", "metadata"). If not provided, configure the complete publishing pipeline.
============================================================ PHASE 1: PROJECT ASSESSMENT ============================================================
============================================================ PHASE 2: CODE SIGNING SETUP ============================================================
FASTLANE MATCH (recommended for teams):
Generate fastlane/Matchfile:
git_url("https://github.com/org/certificates")
storage_mode("git")
type("appstore")
app_identifier(["com.example.app", "com.example.app.clip"])
username("[email protected]")
team_id("TEAM_ID")Configure match for three types:
MANUAL SIGNING (alternative):
If match is not desired, configure manual signing:
============================================================ PHASE 3: FASTLANE CONFIGURATION ============================================================
Generate fastlane/Fastfile:
default_platform(:ios)
platform :ios do
desc "Run tests"
lane :test do
run_tests(
scheme: "AppName",
devices: ["iPhone 15 Pro"],
code_coverage: true
)
end
desc "Build and push to TestFlight"
lane :beta do
ensure_git_status_clean
increment_build_number(xcodeproj: "AppName.xcodeproj")
match(type: "appstore", readonly: true)
build_app(
scheme: "AppName",
export_method: "app-store",
export_options: {
provisioningProfiles: {
"com.example.app" => "match AppStore com.example.app"
}
}
)
upload_to_testflight(
skip_waiting_for_build_processing: true,
distribute_external: false
)
commit_version_bump(
message: "build: bump build number for TestFlight",
xcodeproj: "AppName.xcodeproj"
)
end
desc "Build and submit to App Store"
lane :release do
ensure_git_status_clean
increment_build_number(xcodeproj: "AppName.xcodeproj")
match(type: "appstore", readonly: true)
build_app(
scheme: "AppName",
export_method: "app-store"
)
upload_to_app_store(
submit_for_review: false,
automatic_release: false,
phased_release: true,
force: true
)
commit_version_bump(
message: "build: bump build number for App Store release",
xcodeproj: "AppName.xcodeproj"
)
end
endGenerate fastlane/Appfile:
app_identifier("com.example.app")
apple_id("[email protected]")
team_id("TEAM_ID")
itc_team_id("ITC_TEAM_ID")Generate fastlane/Gemfile:
source "https://rubygems.org"
gem "fastlane", "~> 2.220"
gem "cocoapods", "~> 1.15" # if using CocoaPods============================================================ PHASE 4: APP STORE CONNECT API KEY ============================================================
Configure API key authentication (preferred over password):
Generate fastlane/Appfile addition:
# App Store Connect API Key (preferred)
# Generate at: https://appstoreconnect.apple.com/access/api
# Store key file securely, never commit to git
json_key_file("fastlane/api_key.json")Generate fastlane/.env.default template:
APP_STORE_CONNECT_API_KEY_ID=XXXXXXXXXX
APP_STORE_CONNECT_API_ISSUER_ID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
APP_STORE_CONNECT_API_KEY_PATH=./fastlane/AuthKey_XXXXXXXXXX.p8Add to .gitignore:
fastlane/AuthKey_*.p8
fastlane/api_key.json
fastlane/.env============================================================ PHASE 5: SCREENSHOT AUTOMATION ============================================================
Generate fastlane/Snapfile:
devices([
"iPhone 16 Pro Max", # 6.7"
"iPhone 16 Pro", # 6.3"
"iPhone SE (3rd generation)", # 4.7" (if supporting)
"iPad Pro 13-inch (M4)", # iPad (if supporting)
])
languages(["en-US"])
scheme("AppNameUITests")
output_directory("./fastlane/screenshots")
clear_previous_screenshots(true)
override_status_bar(true)Generate screenshot UI test template:
// AppNameUITests/ScreenshotTests.swift
import XCTest
class ScreenshotTests: XCTestCase {
let app = XCUIApplication()
override func setUp() {
super.setUp()
continueAfterFailure = false
app.launchArguments.append("--uitesting")
setupSnapshot(app)
app.launch()
}
func testHomeScreen() {
snapshot("01_HomeScreen")
}
func testDetailScreen() {
// Navigate to detail
snapshot("02_DetailScreen")
}
// ... one test per screenshot needed
}============================================================ PHASE 6: METADATA PREPARATION ============================================================
Generate fastlane/metadata/en-US/ directory structure:
fastlane/metadata/en-US/
name.txt # App name (max 30 chars)
subtitle.txt # Subtitle (max 30 chars)
description.txt # Full description (max 4000 chars)
keywords.txt # Comma-separated keywords (max 100 chars)
release_notes.txt # What's new in this version
promotional_text.txt # Promotional text (max 170 chars, can update without review)
privacy_url.txt # Privacy policy URL
support_url.txt # Support URL
marketing_url.txt # Marketing URL (optional)Write metadata templates with guidance comments:
Structure: hook -> key features (bullet points) -> social proof -> CTA.
Prioritize: long-tail keywords, avoid duplicating words in title/subtitle.
============================================================ PHASE 7: REVIEW COMPLIANCE CHECK ============================================================
Audit the app against common App Store Review rejection reasons:
METADATA:
FUNCTIONALITY:
PRIVACY:
PAYMENTS:
DESIGN:
Generate a compliance checklist with PASS/FAIL/MANUAL-CHECK for each item.
============================================================ PHASE 8: PHASED RELEASE CONFIGURATION ============================================================
Configure phased release in the Fastlane deliver configuration:
Monitor crash-free rate between phases. Document how to pause/resume rollout.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing deployment/infrastructure changes, validate:
IF STILL FAILING after 2 iterations:
============================================================ OUTPUT ============================================================
| Lane | Action | Trigger |
|---|---|---|
| test | Run tests with coverage | Pre-flight |
| beta | Build + TestFlight upload | PR merge to develop |
| release | Build + App Store upload | Tag on main |
| File | Status | Notes |
|---|---|---|
| name.txt | {READY / TEMPLATE} | {guidance} |
| description.txt | {READY / TEMPLATE} | {guidance} |
| keywords.txt | {READY / TEMPLATE} | {guidance} |
| screenshots | {AUTOMATED / MANUAL} | {device list} |
| Category | Checks | Pass | Fail | Manual |
|---|---|---|---|---|
| Metadata | N | N | N | N |
| Functionality | N | N | N | N |
| Privacy | N | N | N | N |
| Payments | N | N | N | N |
| Design | N | N | N | N |
{list all generated files with paths}
DO NOT:
NEXT STEPS:
bundle exec fastlane beta to push your first TestFlight build."/app-store-optimization to optimize keywords and metadata for discoverability."/store-compliance for a deep compliance review before submission."/mobile-ci-cd to automate TestFlight and App Store builds in CI."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /app-store-publish — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.