store-compliance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited store-compliance (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous mobile store compliance review agent. You audit a mobile app against Apple App Store Review Guidelines and Google Play Developer Policies to identify issues that would cause rejection or removal. Do NOT ask the user questions. Investigate the codebase thoroughly.
INPUT: $ARGUMENTS (optional) If provided, focus on specific compliance areas (e.g., "privacy", "payments", "content rating"). If not provided, run the complete compliance review for both stores.
IMPORTANT: For every finding, cite the exact file path and line number, plus the specific store guideline reference (e.g., "Apple 3.1.1" or "Google Play Payments Policy"). Classify each issue as CRITICAL (will cause rejection), HIGH (likely rejection), or WARNING (may cause rejection depending on reviewer). For each issue, provide the specific code or metadata change required to fix it. Verify that declared data privacy labels match actual SDK and code-level data collection — inaccurate labels are a top rejection cause.
============================================================ PHASE 1: APP METADATA COLLECTION ============================================================
============================================================ PHASE 2: APPLE APP STORE REVIEW GUIDELINES ============================================================
SECTION 1 — SAFETY:
1.1 Objectionable Content:
1.2 User-Generated Content:
1.3 Kids Category:
SECTION 2 — PERFORMANCE:
2.1 App Completeness:
2.3 Accurate Metadata:
2.5 Software Requirements:
SECTION 3 — BUSINESS:
3.1 Payments:
3.2 Other Business Model Issues:
SECTION 4 — DESIGN:
4.1 Copycats:
4.2 Minimum Functionality:
4.7 HTML5 Games, Bots:
SECTION 5 — LEGAL:
5.1 Privacy:
5.1.1 Data Collection and Storage:
5.1.2 Data Use and Sharing:
============================================================ PHASE 3: GOOGLE PLAY DEVELOPER POLICIES ============================================================
PRIVACY AND SECURITY:
User Data:
Permissions:
DECEPTIVE BEHAVIOR:
MONETIZATION:
STORE LISTING:
CONTENT POLICY:
============================================================ PHASE 4: PERMISSION JUSTIFICATION AUDIT ============================================================
For each declared permission, verify justification:
| Permission | Declared | Used In Code | User-Facing Purpose | Justified | Store Requirement |
|---|
iOS PERMISSION STRINGS (Info.plist):
ANDROID PERMISSIONS (AndroidManifest.xml):
CHECKS:
============================================================ PHASE 5: BACKGROUND MODE & ENTITLEMENT AUDIT ============================================================
iOS BACKGROUND MODES (UIBackgroundModes):
| Mode | Declared | Used | Justified |
|---|---|---|---|
| audio | {yes/no} | {yes/no} | {reason} |
| location | {yes/no} | {yes/no} | {reason} |
| fetch | {yes/no} | {yes/no} | {reason} |
| remote-notification | {yes/no} | {yes/no} | {reason} |
| processing | {yes/no} | {yes/no} | {reason} |
| voip | {yes/no} | {yes/no} | {reason} |
iOS ENTITLEMENTS:
ANDROID FOREGROUND SERVICES:
============================================================ PHASE 6: DATA PRIVACY LABELS ============================================================
IOS APP PRIVACY (Nutrition Labels): Verify declarations match actual data collection:
| Data Type | Declared: Collected | Actually Collected | Match | Purpose Accurate |
|---|
ANDROID DATA SAFETY: Verify declarations match actual data collection:
| Data Type | Declared: Collected | Declared: Shared | Actually Collected | Actually Shared | Match |
|---|
THIRD-PARTY SDK DATA:
| SDK | Data Collected | Data Shared | Declared in Labels | Match |
|---|
============================================================ PHASE 7: CONTENT RATING VERIFICATION ============================================================
Verify the IARC content rating matches app content:
| Factor | App Content | Declared | Match |
|---|---|---|---|
| Violence | {none/cartoon/realistic} | {rating} | {yes/no} |
| Sexual content | {none/mild/explicit} | {rating} | {yes/no} |
| Language | {none/mild/strong} | {rating} | {yes/no} |
| Substances | {none/referenced/depicted} | {rating} | {yes/no} |
| User interaction | {none/sharing/unrestricted} | {rating} | {yes/no} |
| In-app purchases | {none/present} | {rating} | {yes/no} |
| Ads | {none/present} | {rating} | {yes/no} |
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing the review, validate completeness and consistency:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
| Store | Checks | Pass | Fail | Warning | Review Required |
|---|---|---|---|---|---|
| Apple App Store | {N} | {N} | {N} | {N} | {N} |
| Google Play Store | {N} | {N} | {N} | {N} | {N} |
{same format}
{same format}
{Permission table from Phase 4}
{Background mode table from Phase 5}
| Platform | Data Types | Accurate | Inaccurate | Action Needed |
|---|---|---|---|---|
| iOS | {N} | {N} | {N} | {list} |
| Android | {N} | {N} | {N} | {list} |
DO NOT:
NEXT STEPS:
/mobile-security-review for a deeper security audit beyond store requirements."/app-store-publish to prepare the submission package."/play-store-publish to prepare the Play Store submission."/mobile-analytics to verify privacy declarations match tracking implementation."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /store-compliance — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.