Agent skill · Audited from source

asc-metadata-sync

skill · rudrankriyam/app-store-connect-cli-skillsMIT licenceAudited 27 Oct 2026 · source 2b8a88b29324

★ 1,107pushed today
✓SAFEGrade B · 89/100 · 27 Oct 2026 · 2b8a88b
1,107repo stars · whole rudrankriyam/app-store-connect-cli-skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 2b8a88b29324 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Sync, validate, and apply App Store metadata and store assets with asc. Use when updating localizations, keywords, App Clip or preview assets, Asset Library media and placements, or migrating legacy fastlane metadata.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “asc-metadata-sync (rudrankriyam/app-store-connect-cli-skills)”. Retrieved 27 Oct 2026. https://modelsatlas.com/skills/rudrankriyam/asc-metadata-sync

2 skills are called “asc-metadata-sync”. You are viewing rudrankriyam/app-store-connect-cli-skills.

Trust audit

Audit 0.4.1 · source read 27 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 2b8a88b29324 · 27 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherrudrankriyam GitHub organizationOwner of the repository this skill is read from
  • Source folderrudrankriyam/app-store-connect-cli-skills/skills/asc-metadata-syncThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict2b8a88b29324A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Sync, validate, and apply App Store metadata and store assets with asc. Use when updating localizations, keywords, App Clip or preview assets, Asset Library media and placements, or migrating legacy fastlane metadata.

---
name: asc-metadata-sync
description: Sync, validate, and apply App Store metadata and store assets with asc. Use when updating localizations, keywords, App Clip or preview assets, Asset Library media and placements, or migrating legacy fastlane metadata.
---

# asc metadata sync

Use this skill to keep App Store metadata in sync with App Store Connect. Prefer the canonical `asc metadata` workflow for app-info and version localization fields. Use the lower-level `asc localizations` and `asc migrate` commands only when the user specifically needs `.strings` files or legacy fastlane-format metadata.

## Current canonical workflow

### 1. Pull canonical metadata

```bash
asc metadata pull --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"
```

If the app has multiple app-info records, resolve the app-info ID first and pass it explicitly:

```bash
asc apps info list --app "APP_ID" --output table
asc metadata pull --app "APP_ID" --app-info "APP_INFO_ID" --version "1.2.3" --platform IOS --dir "./metadata"
```

### 2. Edit local files

Canonical files are written under:

- `metadata/app-info/<locale>.json` for app-level fields: `name`, `subtitle`, `privacyPolicyUrl`, `privacyChoicesUrl`, `privacyPolicyText`
- `metadata/version/<version>/<locale>.json` for version fields: `description`, `keywords`, `marketingUrl`, `promotionalText`, `supportUrl`, `whatsNew`

Copyright is not a localization field. Manage it with:

```bash
asc versions update --version-id "VERSION_ID" --copyright "2026 Your Company"
```

### 3. Validate before upload

```bash
asc metadata validate --dir "./metadata" --output table
```

For subscription apps, include the extra Terms of Use / EULA heuristic:

```bash
asc metadata validate --dir "./metadata" --subscription-app --output table
```

### 4. Preview and apply

Run a dry run first:

```bash
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --dry-run --output table
```

Apply after the plan looks correct:

```bash
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"
```

Use `asc metadata apply` when the user wants the apply-named command shape for the same canonical files:

```bash
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --dry-run
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"
```

For a review-artifact workflow with explicit approval before mutation, use the metadata review commands introduced in `asc` 2.6.1:

```bash
asc metadata plan --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --review-dir ".asc/metadata/review"
asc metadata approve --review-dir ".asc/metadata/review" --all
asc metadata status --review-dir ".asc/metadata/review" --output table
asc metadata apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --review-dir ".asc/metadata/review" --confirm
```

Use `asc metadata approve --key "version:1.2.3:en-US:whatsNew"` or `--scope app-info,version` when the user wants selective approval artifacts before the guarded apply. Version-scoped keys include the App Store version string.

## App Clip and preview transfers

Metadata pull/push defaults to localization text. Select asset scopes explicitly:

```bash
asc metadata pull --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --include localizations,app-clip,previews
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --include localizations,app-clip,previews --dry-run
asc metadata push --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --include localizations,app-clip,previews --confirm
```

Preview validation requires `ffprobe`. App Clip header replacement deletes the old
header first and also requires `--allow-deletes`; authorize that replacement explicitly.
Exports may contain HLS `.m3u8` playlists and `.preview.json` references, not original
videos. Matching remote previews can be reused; an unmatched reference needs the
original video or exclusion of `previews` from `--include`. Renaming a playlist to
`.mp4` does not make it uploadable. Direct `video-previews download` also returns
playlists; use a `.m3u8` output path for individual downloads.

For reusable library media, headers/search creative assets, or localized placements,
read [Asset Library workflows](references/asset-library.md). These are separate from
App Clip header images and ordinary metadata text.

## Keyword-only workflow

Use this when only the version-localization `keywords` field should change:

```bash
asc metadata keywords diff --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata"
asc metadata keywords apply --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --confirm
```

For importing keyword research:

```bash
asc metadata keywords import --dir "./metadata" --version "1.2.3" --locale "en-US" --input "./keywords.csv"
asc metadata keywords sync --app "APP_ID" --version "1.2.3" --platform IOS --dir "./metadata" --input "./keywords.csv"
```

## Quick field updates

For one-off version-localization edits, pass an explicit version selector. Use `--version-id` for deterministic updates when you already have it, or `--version` plus `--platform` when working from a version string.

```bash
asc apps info edit --app "APP_ID" --version-id "VERSION_ID" --locale "en-US" --whats-new "Bug fixes and improvements"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --description "Your app description here"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --keywords "keyword1,keyword2,keyword3"
asc apps info edit --app "APP_ID" --version "1.2.3" --platform IOS --locale "en-US" --support-url "https://support.example.com"
```

For app-info fields, prefer the post-create setup command:

```bash
asc app-setup info set --app "APP_ID" --primary-locale "en-US" --privacy-policy-url "https://example.com/

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 2b8a88b

Download folder ↗
git clone https://github.com/rudrankriyam/app-store-connect-cli-skills
git -C app-store-connect-cli-skills checkout 2b8a88b29324

The author documents no install command, so this uses the repository directly. Our verdict covers commit 2b8a88b29324 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 2b8a88b29324

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/rudrankriyam/asc-metadata-sync/badge.svg)](https://modelsatlas.com/skills/rudrankriyam/asc-metadata-sync/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

asc-ppp-pricing✓SAFE

rorkai/app-store-connect-cli-skills

Set territory-specific pricing for subscriptions and in-app purchases using current asc setup, pricing summary, price import, and price schedule commands. Use when adjusting prices by country or implementing localized…

★ 1.1kGrade B
asc-release-flow✓SAFE

rorkai/app-store-connect-cli-skills

Orchestrate App Store releases with asc, including staging a version, uploading or building an artifact, publishing, and submitting for review. Use when the user wants to prepare or execute a release. Keep Game Center…

★ 1.1kGrade B
asc-release-flow✓SAFE

rudrankriyam/app-store-connect-cli-skills

Orchestrate App Store releases with asc, including staging a version, uploading or building an artifact, publishing, and submitting for review. Use when the user wants to prepare or execute a release. Keep Game Center…

★ 1.1kGrade B
asc-revenuecat-catalog-sync✓SAFE

rudrankriyam/app-store-connect-cli-skills

Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across…

★ 1.1kGrade B
asc-notarization✓SAFE

rorkai/app-store-connect-cli-skills

Archive, export, and notarize macOS apps using xcodebuild and asc. Use when you need to prepare a macOS app for distribution outside the App Store with Developer ID signing and Apple notarization.

★ 1.1kGrade B
asc-ppp-pricing✓SAFE

rudrankriyam/app-store-connect-cli-skills

Set territory-specific pricing for subscriptions and in-app purchases using current asc setup, pricing summary, price import, and price schedule commands. Use when adjusting prices by country or implementing localized…

★ 1.1kGrade B

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/rudrankriyam/asc-metadata-sync/badge.svg)](https://modelsatlas.com/skills/rudrankriyam/asc-metadata-sync/)

Questions about asc-metadata-sync

What does the asc-metadata-sync skill do?
Skills to automate app store deployed and everything related to it using the asc cli
Is asc-metadata-sync safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can asc-metadata-sync access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
What do I need installed to use asc-metadata-sync?
Its own instructions reference ffprobe. Dependencies are pinned to exact versions.
How current is this page?
The grade is for one exact copy of the source (2b8a88b29324), read on 2026-10-27. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.