Agent skill · Audited from source
asc-aso-audit
skill · rorkai/app-store-connect-cli-skillsMIT licenceAudited 22 Oct 2026 · source c079831542f6
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit c079831542f6 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Run an offline ASO audit on canonical App Store metadata under `./metadata` and surface keyword gaps using Astro MCP. Use after pulling metadata with `asc metadata pull`.
Cite
Cite this page
ModelsAtlas. “asc-aso-audit (rorkai/app-store-connect-cli-skills)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/rorkai/asc-aso-audit
2 skills are called “asc-aso-audit”. You are viewing rorkai/app-store-connect-cli-skills.
- rorkai/app-store-connect-cli-skills★ 1.1k✓SAFE
- rudrankriyam/app-store-connect-cli-skills★ 1.1k✓SAFE
Trust audit
Audit 0.4.1 · source read 22 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha c079831542f6 · 22 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherrorkai GitHub organizationOwner of the repository this skill is read from
- Source folderrorkai/app-store-connect-cli-skills/skills/asc-aso-auditThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdictc079831542f6A new audit runs when the source changes
- Repository statusNot archivedLast push 1 day ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Run an offline ASO audit on canonical App Store metadata under `./metadata` and surface keyword gaps using Astro MCP. Use after pulling metadata with `asc metadata pull`.
---
name: asc-aso-audit
description: Run an offline ASO audit on canonical App Store metadata under `./metadata` and surface keyword gaps using Astro MCP. Use after pulling metadata with `asc metadata pull`.
---
# asc ASO audit
Run a two-phase ASO audit: offline checks against local metadata files, then keyword gap analysis via Astro MCP.
When available, include Apple-generated app tags as a discoverability signal.
## Preconditions
- Metadata pulled locally into canonical files via `asc metadata pull --app "APP_ID" --version "1.2.3" --dir "./metadata"`.
- If metadata came from `asc migrate export` or `asc localizations download`, normalize it into the canonical `./metadata` layout before running this skill.
- For Astro gap analysis: app tracked in Astro MCP (optional — offline checks run without it).
- For Apple-generated discoverability tags: `asc app-tags list --app "APP_ID" --output json` works when the API returns tags for the app.
## Before You Start
1. Read `references/aso_rules.md` to understand the rules each check enforces.
2. Identify the **latest version directory** under `metadata/version/` (highest semantic version number). Use this for all version-level fields.
3. The **primary locale** is `en-US` unless the user specifies otherwise.
## Metadata File Paths
- **App-info fields** (`subtitle`): `metadata/app-info/{locale}.json`
- **Version fields** (`keywords`, `description`, `whatsNew`): `metadata/version/{latest-version}/{locale}.json`
- **App name**: May not be present in exported metadata. If `name` is missing from the app-info JSON, fetch it via `asc apps info list` or ask the user. Do not flag it as a missing-field error.
## Phase 1: Offline Checks
Run these 5 checks against the local metadata directory. No network calls required.
### 1. Keyword Waste
Tokenize the `subtitle` field (and `name` if available). Flag any token that also appears in the `keywords` field — it is already indexed and wastes keyword budget.
```
Severity: ⚠️ Warning
Example: "quran" appears in subtitle AND keywords — remove from keywords to free 6 characters
```
How to check:
1. Read `metadata/app-info/{locale}.json` for `subtitle` (and `name` if present)
2. Read `metadata/version/{latest-version}/{locale}.json` for `keywords`
3. Tokenize subtitle (+ name):
- **Latin/Cyrillic scripts:** split by whitespace, strip leading/trailing punctuation, lowercase
- **Chinese/Japanese/Korean:** split by `、` `,` `,` or iterate characters — each character or character-group is a token. Whitespace tokenization does not work for CJK.
- **Arabic:** split by whitespace, then also generate prefix-stripped variants (remove ال prefix) since Apple likely normalizes definite articles. For example, "القرآن" in subtitle should flag both "القرآن" and "قرآن" in keywords.
4. Split keywords by comma, trim whitespace, lowercase
5. Report intersection (including fuzzy matches from prefix stripping)
### Optional: App Tag Alignment
App tags are Apple-generated labels that can appear in search results and product pages. They are not editable ASO metadata, but they are useful evidence for whether Apple's classification matches the intended positioning.
```bash
asc app-tags list --app "APP_ID" --output json
asc app-tags view --app "APP_ID" --id "TAG_ID" --output json
```
Use tags as context only:
- If visible tags reinforce the subtitle/keyword strategy, note the alignment.
- If tags point to an unintended category or use case, recommend metadata/category changes that may improve future classification.
- Do not promise that changing metadata will immediately change Apple-generated tags.
### Optional: Official Apple Search Plan
When both App Store Connect and Apple Ads credentials are configured, use the
experimental, read-only plan to join the selected metadata with official paid
search evidence:
```bash
asc optimize search plan \
--app "APP_ID" \
--version "1.2.3" \
--ad-account "AD_ACCOUNT_ID" \
--country "US" \
--genre "PRODUCTIVITY_UTILITIES" \
--locale "en-US" \
--out-dir ".asc/optimization/1.2.3" \
--output markdown
```
- Authenticate App Store Connect with `asc auth` and Apple Ads separately with
`asc ads auth login`; the two credential sets are independent.
- Treat the generated CSV and JSON files as review artifacts. The command does
not apply metadata, exact keywords, or negative keywords, and partial Apple
Ads source failures stay visible in the report.
- Keep Apple's popularity, app-specific paid reach, paid search outcomes, and
metadata coverage distinct. Do not infer organic rank or keyword difficulty
from this plan.
### 2. Underutilized Fields
Flag fields using less than their recommended minimum:
| Field | Minimum | Limit | Rationale |
|-------|---------|-------|-----------|
| Keywords | 90 chars | 100 | 90%+ usage maximizes indexing |
| Subtitle | 20 chars | 30 | 65%+ usage recommended |
```
Severity: ⚠️ Warning
Example: keywords is 62/100 characters (62%) — 38 characters of indexing opportunity unused
```
### 3. Missing Fields
Flag empty or missing required fields: `subtitle`, `keywords`, `description`, `whatsNew`.
Note: `name` may not be in the export — only flag it if the app-info JSON explicitly contains a `name` key with an empty value.
```
Severity: ❌ Error
Example: subtitle is empty for locale en-US
```
### 4. Bad Keyword Separators
Check the `keywords` field for formatting issues:
- Spaces after commas (`quran, recitation`)
- Semicolons instead of commas (`quran;recitation`)
- Pipes instead of commas (`quran|recitation`)
```
Severity: ❌ Error
Example: keywords contain spaces after commas — wastes 3 characters
```
### 5. Cross-Locale Keyword Gaps
Compare `keywords` fields across all available locales. Flag locales where keywords are identical to the primary locale (`en-US` by default) — this usually means they were not localized.
```
Severity: ⚠️ Warning
Example: ar keywords identical to en-US — likely not localized for Arabic market
``Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit c079831
git clone https://github.com/rorkai/app-store-connect-cli-skills git -C app-store-connect-cli-skills checkout c079831542f6
The author documents no install command, so this uses the repository directly. Our verdict covers commit c079831542f6 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
c079831542f6
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/rorkai/asc-aso-audit/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All automation skills →rorkai/app-store-connect-cli-skills
Set territory-specific pricing for subscriptions and in-app purchases using current asc setup, pricing summary, price import, and price schedule commands. Use when adjusting prices by country or implementing localized…
rorkai/app-store-connect-cli-skills
Orchestrate App Store releases with asc, including staging a version, uploading or building an artifact, publishing, and submitting for review. Use when the user wants to prepare or execute a release. Keep Game Center…
rudrankriyam/app-store-connect-cli-skills
Orchestrate App Store releases with asc, including staging a version, uploading or building an artifact, publishing, and submitting for review. Use when the user wants to prepare or execute a release. Keep Game Center…
rudrankriyam/app-store-connect-cli-skills
Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across…
rorkai/app-store-connect-cli-skills
Archive, export, and notarize macOS apps using xcodebuild and asc. Use when you need to prepare a macOS app for distribution outside the App Store with Developer ID signing and Apple notarization.
rudrankriyam/app-store-connect-cli-skills
Set territory-specific pricing for subscriptions and in-app purchases using current asc setup, pricing summary, price import, and price schedule commands. Use when adjusting prices by country or implementing localized…
Add this badge to your README
[](https://modelsatlas.com/skills/rorkai/asc-aso-audit/)
<a href="https://modelsatlas.com/skills/rorkai/asc-aso-audit/"><img src="https://modelsatlas.com/skills/rorkai/asc-aso-audit/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about asc-aso-audit
What does the asc-aso-audit skill do?
Is asc-aso-audit safe to install?
What can asc-aso-audit access on my machine?
How current is this page?
Sources
- github.com/rorkai/app-store-connect-cli-skills/tree/main/skills/ — the audited source at commit c079831542f6 and every finding aboveObserved · 22 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the asc-aso-audit skill do?
- Is asc-aso-audit safe to install?
- What can asc-aso-audit access on my machine?