Is appstore-notary-runner safe to install?

SaferSkills independently audited appstore-notary-runner (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/appstore-notary-runner/SKILL.md · 1 file

skills/appstore-notary-runner/SKILL.md2.3 KB · Markdown

name: appstore-notary-runner

description: Use for the concrete macOS Developer ID notarization command path with xcodebuild export plus `asc notarization` submit, status, log, and stapling. Not for broad packaging readiness review or signing-only diagnosis.

App Store Notary Runner

Use for macOS apps distributed outside the App Store with Developer ID signing and Apple notarization.

Use macos-notarization-packager first when the artifact is not clearly distribution-ready. Use macos-signing-inspector for local code-signing, entitlement, Gatekeeper, or trust-policy diagnosis.

Preconditions

Xcode/CLT configured.
asc auth login or ASC_*.
Developer ID Application certificate in keychain.
App builds for macOS.

Command Plan Helper

For a deterministic command plan, run the helper from the plugin root:

python3 "$PLUGIN_ROOT/skills/appstore-notary-runner/scripts/notary_plan.py" \
  --app-name "YourApp" --scheme "YourMacScheme" \
  --archive-path "/tmp/YourApp.xcarchive" \
  --export-path "/tmp/YourAppExport" \
  --app-path "/tmp/YourAppExport/YourApp.app" \
  --zip-path "/tmp/YourAppExport/YourApp.zip" \
  --file "/tmp/YourAppExport/YourApp.zip" \
  --include-archive --include-export --include-zip --include-submit \
  --wait --confirming-actions

The helper prints commands only; it does not build, export, upload, staple, or change trust settings. Commands that write local files or submit to Apple require --confirming-actions. Pass --json for machine-readable output.

Workflow

Run read-only preflight first: signing identities, trust settings, recent notarization submissions, and existing submission status/log when an ID is known.
If the artifact is not clearly Developer ID ready, route to macos-notarization-packager before exporting or submitting.
Archive, export with Developer ID options, verify code-signing authority/timestamp, package as zip/DMG/PKG, then submit.
Fetch status/log output and repair signed nested binaries, hardened runtime, timestamp, or trust issues before retrying.
Staple only after Apple accepts the notarization submission.

References

references/appstore-notary-runner.md for detailed preflight, archive, export, submit, status, stapling, DMG, PKG, and troubleshooting commands.

appstore-notary-runner— agent skill

Is appstore-notary-runner safe to install?

App Store Notary Runner

Preconditions

Command Plan Helper

Workflow

References

Audit the pieces. Scan the whole. Decide.