agent-skillsCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: app-store-release-notes-writer
description: Write iOS App Store "What's New" text for each supported app language from git history and localization settings. Use when asked to draft, update, summarize, localize, or style release notes for App Store Connect, especially for "What's New in This Version" text.
---

# App Store Release Notes Writer

## Overview

Use this skill to generate App Store Connect-ready release notes from git history and localization settings.
Keep explanations concise and write release-note bodies in each target locale language.
Apply localization requirements supplied by the task and repository, including established product terminology and official localized feature names.

## Trigger Conditions

Use this skill when the user asks to:

- draft or update `What's New in This Version`
- localize release notes across supported locales
- summarize user-visible changes for App Store Connect

## Workflow

1. Confirm release scope.
- Resolve exact git range (`<previous-tag>..<current-tag>` or equivalent).
- Confirm target app version and release date.

2. Resolve locale coverage.
- Read `Localizable.xcstrings` and `*.xcodeproj/project.pbxproj`.
- Exclude `Base` from output locales.
- Preserve stable locale order for reproducible outputs.
- Emit locale blocks in App Store Connect display order for the supported locales shown in the UI: `en`, `es`, `fr`, `zh-Hans`, `ja`.
- Apply the same ordering to regional variants such as `en-US`, `es-ES`, `fr-FR`, `zh-CN`, and `ja-JP`.
- Do not move the source locale to the front if that would break the App Store Connect display order.

3. Generate source draft.
- Run `scripts/generate_release_notes.py` and extract user-visible changes.
- Keep 2 to 5 outcome-focused bullets.

4. Apply App Store style.
- Use `--style app-store` for intro + bullets (+ optional outro).
- Use `--include-outro` only when it improves readability.
- Use `--exclude-subject-regex` to filter noisy commits.

5. Localize per locale.
- Emit one locale block per supported App Store language.
- Before finalizing translations, check the supplied terminology requirements, existing translations, and official localized feature names.
- For uncertain translations, keep explicit placeholders and mark them as review-needed.

6. Final quality checks.
- Validate version/date/range consistency.
- Ensure text emphasizes user benefit and behavior changes.
- Ensure output is directly pasteable to App Store Connect.

## Safety / Guardrails

- Never fabricate user-facing changes that are not grounded in commits.
- Avoid implementation-detail-heavy bullets.
- Keep locale ordering stable and deterministic.
- Match the emitted locale order to App Store Connect display order instead of source-locale-first ordering.
- Preserve placeholders and formatting tokens exactly.
- Preserve proper nouns and established feature names unless an official localized name is known or the user explicitly asks for a translation.
- Reject malformed locale identifiers before writing per-locale files, and keep every generated locale file directly inside `--output-dir`.
- Treat `.app-store-release-notes-manifest.json` as the ownership record for per-locale files; remove only files recorded by the previous run and leave unrelated output-directory contents untouched.

## Response Contract

Report concisely using localized headings and locale blocks:

1. `Summary` (what changed, source range)
2. `Verification` (range/locales/style checks)
3. `Localized text` (paste-ready)
4. `Translations needing review` (only when placeholders remain)

## Verification

- Confirm all target locales are present exactly once.
- Confirm locale order matches App Store Connect display order for supported locales: `en`, `es`, `fr`, `zh-Hans`, `ja`.
- Confirm unresolved translations are explicitly labeled.
- Confirm generated blocks are plain text and App Store Connect ready.

## Draft Script

Use `scripts/generate_release_notes.py` to create an App Store-ready draft and locale blocks.

```bash
python3 scripts/generate_release_notes.py   --repo /path/to/repository   --from-ref v1.4.0   --to-ref v1.5.0   --app-name ExampleApp   --version 1.5.0   --xcstrings /path/to/App/Resources/Localizable.xcstrings   --project /path/to/App.xcodeproj   --style app-store   --include-outro   --output /tmp/whats-new.md   --output-dir /tmp/whats-new-locales
```

Useful options:

- `--max-items`: Set max bullets per locale.
- `--locales`: Override detected locales (`en,ja,es,fr,zh-Hans`) while still emitting in App Store Connect display order.
- `--source-locale`: Force source locale.
- `--copy-source-to-all-locales`: Fill non-source locales with source text.
- `--translations-json`: Inject finalized localized intro/items/outro.
- `--exclude-subject-regex`: Exclude noisy commit subjects.

## References

- Read `references/release-notes-style.md` for App Store writing rules.
- Read `references/release-notes-template.md` for output structure.

CAUTIONgrade B · trust 85/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (2 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

found

Findings (7)

secret = "OUTSIDE_FAILED_LOG_MUST_NOT_BE_READ"

secret = "SYMLINKED_RUN_MUST_NOT_BE_READ"

.xcode-skill-sync.json

archive.writestr("../../../../escaped.txt", "escaped\n")

self.write_exported_skill("unsafe", skill_name="../../outside")

does not read or copy credential stores. A successful login does not establish

Gates applied: no_behavioural_pass, no_license.