Agent skill · Audited from source

ios-development

skill · rshankras/claude-code-apple-skillsMIT licenceAudited 28 Oct 2026 · source 7fd70e317e5c

★ 837pushed 96 days ago
✕BLOCKGrade F · 59/100 · 23 findings · 7fd70e3
837repo stars · whole rshankras/claude-code-apple-skills

Is it safe? No — BLOCK, grade F (59/100). We read this skill's source at commit 7fd70e317e5c and observed network access and a hard-coded secret (see the findings). The audit raised 23 findings, 9 critical or high. What it does: App Store optimization and marketing skills for descriptions, screenshots, keywords, review responses, and comprehensive promotional strategy. Use when user needs help with App Store presence, ASO, marketing, or…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “ios-development (rshankras/claude-code-apple-skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/rshankras/ios-development

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 9 critical or high findings, starting with “Hard-coded secrets” in tools/lint-fixtures/security/violation/Secrets.swift:2. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 28 Oct 2026

Trust score59/100✕BLOCK F
3 critical6 high1 medium4 low9 info

BLOCK means the audit found something that could harm you or your machine. Grade F is shared by 105 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared3 observations
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsFoundSee the findings; values are never shown

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL2
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL21
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: critical finding, instruction override, no behavioural pass, undeclared transfer.

Findings (23)

CRITICALHard-coded secretssecret.stripe · tools/lint-fixtures/security/violation/Secrets.swift:2
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
static let apiKey = "…"
Why
No further detail recorded for this rule.
Fix
—
CRITICALPrompt injectionprompt.transfer_instruction · skills/generators/live-activity-generator/SKILL.md:211
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
The generated `{Name}ActivityManager` automatically observes push token updates. Send the token to your server when it changes.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injectionprompt.transfer_instruction · skills/generators/push-notifications/SKILL.md:212
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// Send token to your server
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
HIGHPrompt injectionprompt.override · skills/release-review/security-checklist.md:175
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- [ ] Jailbreak detection considered (if needed)
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.override · tools/skill-audit/results/claude-sonnet-5/AUDIT-REPORT.md:432
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- covered: Jailbreak detection can be bypassed by determined attackers and should be used only as defense-in-depth, not the sole pr
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.persistence · skills/testing/flow-walkthrough/SKILL.md:42
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Output each finding as `DEAD-END` / `NO-EDIT-PATH` / `ORPHANS-ENTITY` / `NESTED-NAV` with the file:line and the missing arrow.
Why
instructs the agent to persist itself in the user's environment
Fix
—
HIGHPrompt injectionprompt.persistence · skills/testing/flow-walkthrough/SKILL.md:92
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- 🔴 NO-EDIT-PATH: ContestHistoryView:19 opens read-only ResultsView; a saved Contest can't be reopened to edit. → route to editable setup.
Why
instructs the agent to persist itself in the user's environment
Fix
—
HIGHPrompt injectionprompt.read_system · skills/generators/permission-priming/SKILL.md:210
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// User taps "Take Photo" -> show camera priming -> then system prompt
Why
No further detail recorded for this rule.
Fix
—
HIGHPrompt injectionprompt.read_system · skills/generators/permission-priming/SKILL.md:244
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **Cannot re-show system prompt after denial.** Once the user denies a permission, iOS will never show the system dialog again. You must direct the user to Settings > Privacy to re-enable. Always han
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tools/lint-fixtures/security/violation/Secrets.swift:2
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
static let apiKey = "…"
Why
No further detail recorded for this rule.
Fix
—
LOWPrompt injectionprompt.override · skills/apple-intelligence/foundation-models/safety-and-guardrails.md:44
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Apple-trained guardrails apply to **both input and output**: "Your instructions, prompts, and tool calls are all considered inputs... harmful model outputs are blocked, even if the prompts were craf
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
LOWPrompt injectionprompt.transfer_instruction · skills/generators/live-activity-generator/templates.md:420
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// Callback invoked when the push token changes. Send this token to your server.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · skills/generators/live-activity-generator/templates.md:557
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// The push token can change during the activity lifetime; always send the latest to your server.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · skills/generators/push-notifications/push-notification-patterns.md:82
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// TODO: Implement server token upload
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
INFOPrompt injectionprompt.authority_framing · skills/app-store/rejection-handler/common-rejections.md:64
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
full access to all app features.
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/generators/app-extensions/SKILL.md:250
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
By default keyboard extensions have no network access. The user must explicitly grant "Allow Full Access" in Settings. Without it, URLSession calls fail silently. Design your keyboard to work without
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/generators/app-extensions/templates.md:405
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// The user must enable "Allow Full Access" in Settings for network
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/generators/lapsed-user/templates.md:790
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
"Full access to all premium features",
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/generators/subscription-lifecycle/patterns.md:75
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **User access:** Apple expects you to grant full access during this period
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.credential_read · skills/generators/app-extensions/templates.md:878
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// Load a string from the shared Keychain.
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.credential_read · skills/release-review/privacy-checklist.md:163
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// Users will see: "[App] wants to access [Item] in your keychain"
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.credential_read · skills/release-review/privacy-checklist.md:165
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Text("On first launch, macOS will ask to access credentials from your Keychain. Click 'Always Allow' for permanent access.")
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.read_system · skills/apple-intelligence/foundation-models/safety-and-guardrails.md:44
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Apple-trained guardrails apply to **both input and output**: "Your instructions, prompts, and tool calls are all considered inputs... harmful model outputs are blocked, even if the prompts were craf
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 7fd70e317e5c · 28 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherrshankras GitHub userOwner of the repository this skill is read from
  • Source folderrshankras/claude-code-apple-skillsThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict7fd70e317e5cA new audit runs when the source changes
  • Repository statusNot archivedLast push 96 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: App Store optimization and marketing skills for descriptions, screenshots, keywords, review responses, and comprehensive promotional strategy. Use when user needs help with App Store presence, ASO, marketing, or…

---
name: app-store
description: App Store optimization and marketing skills for descriptions, screenshots, keywords, review responses, and comprehensive promotional strategy. Use when user needs help with App Store presence, ASO, marketing, or customer communication.
allowed-tools: [Read, Write, Edit, Glob, Grep, AskUserQuestion, WebSearch]
last_verified: 2026-07-16
review_by: 2027-06-22
---

# App Store Optimization & Marketing Skills

Skills for optimizing your app's App Store presence and building promotional strategies — from descriptions to comprehensive marketing campaigns.

## When This Skill Activates

Use this skill when the user:
- Needs to write App Store description or promotional text
- Wants to plan screenshot sequence and captions
- Asks about ASO (App Store Optimization) or keywords
- Needs help responding to App Store reviews
- Wants to improve app discoverability
- Asks about marketing strategy, promotion, or user acquisition
- Wants to use App Store features (events, custom pages, offers, featuring)
- Asks about paid acquisition or Apple Search Ads
- App was rejected or wants to avoid rejection

## Available Skills

### marketing-strategy/ ⭐ NEW
Comprehensive marketing strategy advisor — describe your app and get a tailored promotional plan.
- Analyzes app type, monetization model, audience, and lifecycle stage
- Recommends the right App Store features for your situation
- Builds promotional calendar with implementation roadmap
- Orchestrates generator sub-skills for implementation
- Strategy templates for subscription, paid, freemium, and game apps

### app-description-writer/
Generate compelling App Store descriptions that convert.
- Promotional text (170 chars)
- Full description (4000 chars)
- What's New text for updates
- Localization guidance

### screenshot-planner/
Plan App Store screenshot sequences with captions.
- 5-10 screenshot storyboard
- Caption writing
- Device frame recommendations
- Localization considerations

### keyword-optimizer/
Optimize app title, subtitle, and keywords for search.
- Keyword research methodology
- Character limit optimization (100 chars)
- Competitor analysis
- Localization keyword strategy
- **NEW:** Advanced tactics (cross-localization, screenshot indexing)
- **NEW:** Keyword criteria (Pop/Diff sweet spots, opportunity scoring)
- **NEW:** Existing app strategy (safe optimization)

### review-response-writer/
Professional responses to App Store reviews.
- Templates for common scenarios
- Tone and brand voice guidelines
- Turning negative reviews into opportunities
- When to respond vs. when not to

### apple-search-ads/
Apple Search Ads campaign strategy for indie developers.
- Readiness assessment (minimum thresholds before spending)
- Campaign types and keyword strategy
- Budget planning by app stage (launch, growth, scale)
- Bid optimization with CPT benchmarks by category
- Campaign structure templates and measurement KPIs
- Custom Product Pages integration for ad groups

### ad-attribution/
Privacy-preserving paid-traffic measurement with AdAttributionKit (SKAdNetwork's successor) — install + re-engagement attribution, conversion-value design under crowd anonymity, postback testing. (Apple Ads itself attributes via AdServices — see apple-search-ads.)

### rejection-handler/
Handle App Store rejections and prepare submissions to avoid them.
- Pre-submission audit checklist by guideline section
- Rejection analysis and response strategy
- Resolution Center response templates
- Appeal escalation path (Resolution Center → phone → App Review Board)
- Top 20 common rejections with fixes (common-rejections.md)

### originality-check/
Guideline 4.3 anti-spam / originality gate — verify an app (and each portfolio addition) is meaningfully distinct in function, content, and metadata before you invest or submit.

### iap-finalizer/
Take a one-time In-App Purchase from MISSING_METADATA to READY_TO_SUBMIT via the App Store Connect API — price tier plus localized name/description.

### ratings-mechanics/
How ratings actually behave — per-storefront isolation (your US stars show nowhere else), the never-reset rule, and phased release + manual release as rating protection.

### web-presence/
Discovery outside the store app — the apps.apple.com page as a Google citizen, an owned landing page with Smart App Banner, and the deal-site ecosystem that auto-amplifies price drops.

## Related Generator Skills

These generator skills produce code, metadata, and configuration for App Store features:

| Skill | Purpose |
|-------|---------|
| `generators/subscription-offers` | StoreKit 2 code for all subscription offer types |
| `generators/win-back-offers` | Win-back flow for churned subscribers |
| `generators/promoted-iap` | Promoted In-App Purchase setup |
| `generators/in-app-events` | In-App Event metadata templates |
| `generators/custom-product-pages` | Custom Product Page strategy and metadata |
| `generators/product-page-optimization` | A/B test plans for product page |
| `generators/featuring-nomination` | App Store featuring pitch templates |
| `generators/offer-codes-setup` | Offer code distribution strategies |
| `generators/pre-orders` | Pre-order setup and launch timelines |
| `generators/app-store-assets` | Asset specs for all App Store media |

## How to Use

1. User requests App Store help
2. For strategy questions → Read `marketing-strategy/SKILL.md`
3. For paid acquisition → Read `apple-search-ads/SKILL.md`
4. For rejections or submission prep → Read `rejection-handler/SKILL.md`
5. For specific content → Read the relevant sub-skill's SKILL.md
6. For code/implementation → Read the relevant generator skill
7. Ask clarifying questions about the app
8. Generate optimized content
9. Provide alternatives and explain choices

## Key Principles

### 1. User-Focused Copy
- Lead with benefits, not features
- Speak to user pain points
- Use clear, simple language
- Include social proof where possible

### 2. Platform Guidelines
- Stay wi

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 7fd70e3

git clone https://github.com/YOUR_USERNAME/claude-code-apple-skills.git
git clone https://github.com/rshankras/claude-code-apple-skills.git

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 7fd70e317e5c only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK F 59 / 100

    first audit · source 7fd70e317e5c

Similar skills

legal✓SAFE

rshankras/claude-code-apple-skills

Legal document generation and compliance guidance for indie Apple developers. Covers privacy policies, terms of service, EULAs, GDPR/CCPA/DPDP compliance, and Apple App Store legal requirements. Use when user needs…

★ 838Grade B
growth✓SAFE

rshankras/claude-code-apple-skills

Growth skills for indie Apple developers — user acquisition, analytics interpretation, press/media outreach, community building, and indie business operations. Also covers the stage-by-stage store-growth audit and the…

★ 837Grade B
design✓SAFE

rshankras/claude-code-apple-skills

Design skills for Apple platform UI — Liquid Glass, animations, game feel (haptics, sound, celebrations), UI prototyping, UX writing, SF Symbols, and typography. Use when implementing design language features, adding…

★ 836Grade B
core-ml✓SAFE

rshankras/claude-code-apple-skills

Core ML, Create ML, Vision framework, Natural Language framework, on-device ML integration. Use when user wants image classification, text analysis, object detection, sound classification, model optimization, or custom…

★ 834Grade B
apple-intelligence✓SAFE

rshankras/claude-code-apple-skills

Apple Intelligence skills for on-device AI features including Foundation Models, Visual Intelligence, App Intents, and intelligent assistants. Use when implementing AI-powered features.

★ 830Grade B
App Description Writer✓SAFE

rshankras/claude-code-apple-skills

Generate compelling App Store descriptions that convert browsers into users. Use when writing initial descriptions, improving existing copy, or drafting promotional text and What's New for a major update.

★ 810Grade B

Questions about ios-development

What does the ios-development skill do?
Claude Code skills for Apple platform development (iOS, macOS, iPadOS) — product validation, code generation, App Store optimization, and more
Is ios-development safe to install?
No — not without reading the findings first. The audit graded it F (59/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can ios-development access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does ios-development work with?
Its documentation mentions claude-code, copilot and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (7fd70e317e5c), read on 2026-10-28. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.