appstore-signing-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited appstore-signing-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use for new signing assets, rotation, or team sharing.
Auth is configured (asc auth login or ASC_* env vars), bundle id/platform are known, and certificate creation has a CSR or will use --generate-csr.
asc bundle-ids list --paginateasc bundle-ids create --identifier "com.example.app" --name "Example" --platform IOSasc bundle-ids capabilities list --bundle "BUNDLE_ID"asc bundle-ids capabilities add --bundle "BUNDLE_ID" --capability ICLOUD--settings '[{"key":"ICLOUD_VERSION","options":[{"key":"XCODE_13","enabled":true}]}]' when requiredasc certificates list --certificate-type IOS_DISTRIBUTIONasc certificates create --certificate-type IOS_DISTRIBUTION --csr "./cert.csr"asc certificates create --certificate-type IOS_DISTRIBUTION --generate-csr --key-out "./signing/dist.key" --csr-out "./signing/dist.csr"asc profiles create --name "AppStore Profile" --profile-type IOS_APP_STORE --bundle "BUNDLE_ID" --certificate "CERT_ID"--device "DEVICE_ID"asc profiles download --id "PROFILE_ID" --output "./profiles/AppStore.mobileprovision"asc profiles inspect --path "./profiles/AppStore.mobileprovision" --output tableasc profiles inspect --path "./profiles/AppStore.mobileprovision" --entitlements --output markdownasc profiles local install --path "./profiles/AppStore.mobileprovision"asc profiles local list --output tableasc certificates revoke --id "CERT_ID" --confirmasc profiles delete --id "PROFILE_ID" --confirmasc profiles local clean --expired --dry-runasc profiles local clean --expired --confirmUse asc signing sync as a lightweight match-style encrypted git store.
asc signing sync push \
--bundle-id "com.example.app" \
--profile-type IOS_APP_STORE \
--repo "[email protected]:team/certs.git" \
--password "$MATCH_PASSWORD"
asc signing sync pull \
--repo "[email protected]:team/certs.git" \
--password "$MATCH_PASSWORD" \
--output-dir "./signing"--password falls back to ASC_MATCH_PASSWORD. Pull writes files only; keychain import/profile install is separate.
Check --help for enum values. Use --paginate for large accounts. --certificate accepts comma-separated IDs. Device management uses asc devices with UDID. Local profile commands operate on disk, not ASC API resources.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.