Agent skill · Audited from source
ios-development
skill · rshankras/claude-code-apple-skillsMIT licenceAudited 28 Oct 2026 · source 7fd70e317e5c
Is it safe? No — BLOCK, grade F (59/100). We read this skill's source at commit 7fd70e317e5c and observed network access and a hard-coded secret (see the findings). The audit raised 23 findings, 9 critical or high. What it does: App Store optimization and marketing skills for descriptions, screenshots, keywords, review responses, and comprehensive promotional strategy. Use when user needs help with App Store presence, ASO, marketing, or…
Cite
Cite this page
ModelsAtlas. “ios-development (rshankras/claude-code-apple-skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/rshankras/ios-development
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 9 critical or high findings, starting with “Hard-coded secrets” in tools/lint-fixtures/security/violation/Secrets.swift:2. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 28 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade F is shared by 105 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared3 observations
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsFoundSee the findings; values are never shown
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | FAIL | 2 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 21 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: critical finding, instruction override, no behavioural pass, undeclared transfer.
Findings (23)
CRITICALHard-coded secretssecret.stripe · tools/lint-fixtures/security/violation/Secrets.swift:2
static let apiKey = "…"
- Why
- No further detail recorded for this rule.
- Fix
- —
CRITICALPrompt injectionprompt.transfer_instruction · skills/generators/live-activity-generator/SKILL.md:211
The generated `{Name}ActivityManager` automatically observes push token updates. Send the token to your server when it changes.- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injectionprompt.transfer_instruction · skills/generators/push-notifications/SKILL.md:212
// Send token to your server
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
HIGHPrompt injectionprompt.override · skills/release-review/security-checklist.md:175
- [ ] Jailbreak detection considered (if needed)
- Why
- asks the agent to drop prior instructions or safety
- Fix
- remove the instruction
HIGHPrompt injectionprompt.override · tools/skill-audit/results/claude-sonnet-5/AUDIT-REPORT.md:432
- covered: Jailbreak detection can be bypassed by determined attackers and should be used only as defense-in-depth, not the sole pr
- Why
- asks the agent to drop prior instructions or safety
- Fix
- remove the instruction
HIGHPrompt injectionprompt.persistence · skills/testing/flow-walkthrough/SKILL.md:42
Output each finding as `DEAD-END` / `NO-EDIT-PATH` / `ORPHANS-ENTITY` / `NESTED-NAV` with the file:line and the missing arrow.
- Why
- instructs the agent to persist itself in the user's environment
- Fix
- —
HIGHPrompt injectionprompt.persistence · skills/testing/flow-walkthrough/SKILL.md:92
- 🔴 NO-EDIT-PATH: ContestHistoryView:19 opens read-only ResultsView; a saved Contest can't be reopened to edit. → route to editable setup.
- Why
- instructs the agent to persist itself in the user's environment
- Fix
- —
HIGHPrompt injectionprompt.read_system · skills/generators/permission-priming/SKILL.md:210
// User taps "Take Photo" -> show camera priming -> then system prompt
- Why
- No further detail recorded for this rule.
- Fix
- —
HIGHPrompt injectionprompt.read_system · skills/generators/permission-priming/SKILL.md:244
- **Cannot re-show system prompt after denial.** Once the user denies a permission, iOS will never show the system dialog again. You must direct the user to Settings > Privacy to re-enable. Always han
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tools/lint-fixtures/security/violation/Secrets.swift:2
static let apiKey = "…"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.override · skills/apple-intelligence/foundation-models/safety-and-guardrails.md:44
- Apple-trained guardrails apply to **both input and output**: "Your instructions, prompts, and tool calls are all considered inputs... harmful model outputs are blocked, even if the prompts were craf
- Why
- asks the agent to drop prior instructions or safety
- Fix
- remove the instruction
LOWPrompt injectionprompt.transfer_instruction · skills/generators/live-activity-generator/templates.md:420
/// Callback invoked when the push token changes. Send this token to your server.
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · skills/generators/live-activity-generator/templates.md:557
/// The push token can change during the activity lifetime; always send the latest to your server.
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · skills/generators/push-notifications/push-notification-patterns.md:82
// TODO: Implement server token upload
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
INFOPrompt injectionprompt.authority_framing · skills/app-store/rejection-handler/common-rejections.md:64
full access to all app features.
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · skills/generators/app-extensions/SKILL.md:250
By default keyboard extensions have no network access. The user must explicitly grant "Allow Full Access" in Settings. Without it, URLSession calls fail silently. Design your keyboard to work without
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · skills/generators/app-extensions/templates.md:405
/// The user must enable "Allow Full Access" in Settings for network
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · skills/generators/lapsed-user/templates.md:790
"Full access to all premium features",
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · skills/generators/subscription-lifecycle/patterns.md:75
- **User access:** Apple expects you to grant full access during this period
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.credential_read · skills/generators/app-extensions/templates.md:878
/// Load a string from the shared Keychain.
- Why
- asks the agent to read credentials
- Fix
- —
INFOPrompt injectionprompt.credential_read · skills/release-review/privacy-checklist.md:163
// Users will see: "[App] wants to access [Item] in your keychain"
- Why
- asks the agent to read credentials
- Fix
- —
INFOPrompt injectionprompt.credential_read · skills/release-review/privacy-checklist.md:165
Text("On first launch, macOS will ask to access credentials from your Keychain. Click 'Always Allow' for permanent access.")- Why
- asks the agent to read credentials
- Fix
- —
INFOPrompt injectionprompt.read_system · skills/apple-intelligence/foundation-models/safety-and-guardrails.md:44
- Apple-trained guardrails apply to **both input and output**: "Your instructions, prompts, and tool calls are all considered inputs... harmful model outputs are blocked, even if the prompts were craf
- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 7fd70e317e5c · 28 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherrshankras GitHub userOwner of the repository this skill is read from
- Source folderrshankras/claude-code-apple-skillsThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict7fd70e317e5cA new audit runs when the source changes
- Repository statusNot archivedLast push 96 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: App Store optimization and marketing skills for descriptions, screenshots, keywords, review responses, and comprehensive promotional strategy. Use when user needs help with App Store presence, ASO, marketing, or…
--- name: app-store description: App Store optimization and marketing skills for descriptions, screenshots, keywords, review responses, and comprehensive promotional strategy. Use when user needs help with App Store presence, ASO, marketing, or customer communication. allowed-tools: [Read, Write, Edit, Glob, Grep, AskUserQuestion, WebSearch] last_verified: 2026-07-16 review_by: 2027-06-22 --- # App Store Optimization & Marketing Skills Skills for optimizing your app's App Store presence and building promotional strategies — from descriptions to comprehensive marketing campaigns. ## When This Skill Activates Use this skill when the user: - Needs to write App Store description or promotional text - Wants to plan screenshot sequence and captions - Asks about ASO (App Store Optimization) or keywords - Needs help responding to App Store reviews - Wants to improve app discoverability - Asks about marketing strategy, promotion, or user acquisition - Wants to use App Store features (events, custom pages, offers, featuring) - Asks about paid acquisition or Apple Search Ads - App was rejected or wants to avoid rejection ## Available Skills ### marketing-strategy/ ⭐ NEW Comprehensive marketing strategy advisor — describe your app and get a tailored promotional plan. - Analyzes app type, monetization model, audience, and lifecycle stage - Recommends the right App Store features for your situation - Builds promotional calendar with implementation roadmap - Orchestrates generator sub-skills for implementation - Strategy templates for subscription, paid, freemium, and game apps ### app-description-writer/ Generate compelling App Store descriptions that convert. - Promotional text (170 chars) - Full description (4000 chars) - What's New text for updates - Localization guidance ### screenshot-planner/ Plan App Store screenshot sequences with captions. - 5-10 screenshot storyboard - Caption writing - Device frame recommendations - Localization considerations ### keyword-optimizer/ Optimize app title, subtitle, and keywords for search. - Keyword research methodology - Character limit optimization (100 chars) - Competitor analysis - Localization keyword strategy - **NEW:** Advanced tactics (cross-localization, screenshot indexing) - **NEW:** Keyword criteria (Pop/Diff sweet spots, opportunity scoring) - **NEW:** Existing app strategy (safe optimization) ### review-response-writer/ Professional responses to App Store reviews. - Templates for common scenarios - Tone and brand voice guidelines - Turning negative reviews into opportunities - When to respond vs. when not to ### apple-search-ads/ Apple Search Ads campaign strategy for indie developers. - Readiness assessment (minimum thresholds before spending) - Campaign types and keyword strategy - Budget planning by app stage (launch, growth, scale) - Bid optimization with CPT benchmarks by category - Campaign structure templates and measurement KPIs - Custom Product Pages integration for ad groups ### ad-attribution/ Privacy-preserving paid-traffic measurement with AdAttributionKit (SKAdNetwork's successor) — install + re-engagement attribution, conversion-value design under crowd anonymity, postback testing. (Apple Ads itself attributes via AdServices — see apple-search-ads.) ### rejection-handler/ Handle App Store rejections and prepare submissions to avoid them. - Pre-submission audit checklist by guideline section - Rejection analysis and response strategy - Resolution Center response templates - Appeal escalation path (Resolution Center → phone → App Review Board) - Top 20 common rejections with fixes (common-rejections.md) ### originality-check/ Guideline 4.3 anti-spam / originality gate — verify an app (and each portfolio addition) is meaningfully distinct in function, content, and metadata before you invest or submit. ### iap-finalizer/ Take a one-time In-App Purchase from MISSING_METADATA to READY_TO_SUBMIT via the App Store Connect API — price tier plus localized name/description. ### ratings-mechanics/ How ratings actually behave — per-storefront isolation (your US stars show nowhere else), the never-reset rule, and phased release + manual release as rating protection. ### web-presence/ Discovery outside the store app — the apps.apple.com page as a Google citizen, an owned landing page with Smart App Banner, and the deal-site ecosystem that auto-amplifies price drops. ## Related Generator Skills These generator skills produce code, metadata, and configuration for App Store features: | Skill | Purpose | |-------|---------| | `generators/subscription-offers` | StoreKit 2 code for all subscription offer types | | `generators/win-back-offers` | Win-back flow for churned subscribers | | `generators/promoted-iap` | Promoted In-App Purchase setup | | `generators/in-app-events` | In-App Event metadata templates | | `generators/custom-product-pages` | Custom Product Page strategy and metadata | | `generators/product-page-optimization` | A/B test plans for product page | | `generators/featuring-nomination` | App Store featuring pitch templates | | `generators/offer-codes-setup` | Offer code distribution strategies | | `generators/pre-orders` | Pre-order setup and launch timelines | | `generators/app-store-assets` | Asset specs for all App Store media | ## How to Use 1. User requests App Store help 2. For strategy questions → Read `marketing-strategy/SKILL.md` 3. For paid acquisition → Read `apple-search-ads/SKILL.md` 4. For rejections or submission prep → Read `rejection-handler/SKILL.md` 5. For specific content → Read the relevant sub-skill's SKILL.md 6. For code/implementation → Read the relevant generator skill 7. Ask clarifying questions about the app 8. Generate optimized content 9. Provide alternatives and explain choices ## Key Principles ### 1. User-Focused Copy - Lead with benefits, not features - Speak to user pain points - Use clear, simple language - Include social proof where possible ### 2. Platform Guidelines - Stay wi
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 7fd70e3
git clone https://github.com/YOUR_USERNAME/claude-code-apple-skills.git git clone https://github.com/rshankras/claude-code-apple-skills.git
git clone https://github.com/rshankras/claude-code-apple-skills git -C claude-code-apple-skills checkout 7fd70e317e5c
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 7fd70e317e5c only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✕BLOCK F 59 / 100
first audit · source
7fd70e317e5c
Similar skills
rshankras/claude-code-apple-skills
Legal document generation and compliance guidance for indie Apple developers. Covers privacy policies, terms of service, EULAs, GDPR/CCPA/DPDP compliance, and Apple App Store legal requirements. Use when user needs…
rshankras/claude-code-apple-skills
Growth skills for indie Apple developers — user acquisition, analytics interpretation, press/media outreach, community building, and indie business operations. Also covers the stage-by-stage store-growth audit and the…
rshankras/claude-code-apple-skills
Design skills for Apple platform UI — Liquid Glass, animations, game feel (haptics, sound, celebrations), UI prototyping, UX writing, SF Symbols, and typography. Use when implementing design language features, adding…
rshankras/claude-code-apple-skills
Core ML, Create ML, Vision framework, Natural Language framework, on-device ML integration. Use when user wants image classification, text analysis, object detection, sound classification, model optimization, or custom…
rshankras/claude-code-apple-skills
Apple Intelligence skills for on-device AI features including Foundation Models, Visual Intelligence, App Intents, and intelligent assistants. Use when implementing AI-powered features.
rshankras/claude-code-apple-skills
Generate compelling App Store descriptions that convert browsers into users. Use when writing initial descriptions, improving existing copy, or drafting promotional text and What's New for a major update.
Questions about ios-development
What does the ios-development skill do?
Is ios-development safe to install?
What can ios-development access on my machine?
Which assistants does ios-development work with?
How current is this page?
Sources
- github.com/rshankras/claude-code-apple-skills — the audited source at commit 7fd70e317e5c and every finding aboveObserved · 28 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the ios-development skill do?
- Is ios-development safe to install?
- What can ios-development access on my machine?