Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/blitzdotdev/blitz-mac/asc-iap-attachnpx skills add blitzdotdev/blitz-mac --skill asc-iap-attachgit clone --depth 1 https://github.com/blitzdotdev/blitz-macWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.02709 |
| Opus 5 | $0.00030 | $0.01354 |
| Sonnet 5 | $0.00012 | $0.00542 |
| Haiku 4.5 | $0.00006 | $0.00271 |
Grade A, and why
asc-iap-attach scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
import json, os, urllib.request, sys How it starts
The opening of the file, as written. The whole thing — 252 lines — stays where its author put it; the contents beside it link to each section on GitHub.
asc iap attach
Use this skill to attach in-app purchases and/or subscriptions to an app version for App Store review. This is the equivalent of checking the boxes in the "Add In-App Purchases or Subscriptions" modal on the version page in App Store Connect.
When to use
- User is preparing an app version for submission and has IAPs or subscriptions to include
- User says "attach IAPs", "add subscriptions to version", "include in-app purchases for review", "select in-app purchases"
- The app version page in ASC shows an "In-App Purchases and Subscriptions" section with items to select
- IAPs/subscriptions have been created and are in "Ready to Submit" state
Background
Apple's official App Store Connect API (POST /v1/subscriptionSubmissions, POST /v1/inAppPurchaseSubmissions) returns FIRST_SUBSCRIPTION_MUST_BE_SUBMITTED_ON_VERSION for first-time IAP/subscription submissions. The reviewSubmissionItems API also does not support subscription or inAppPurchase relationship types.
This skill uses Apple's internal iris API (/iris/v1/subscriptionSubmissions) via cached web session cookies, which supports the submitWithNextAppStoreVersion attribute that the public API lacks. This is the same mechanism the ASC web UI uses when you check the checkbox in the modal.
Preconditions
- Web session file available at
~/.blitz/asc-agent/web-session.json. If no session exists or it has expired (401), call theasc_web_authMCP tool first — this opens the Apple ID login window in Blitz and captures the session automatically. - Know your app ID.
- IAPs and/or subscriptions already exist and are in Ready to Submit state.
- A build is uploaded and attached to the current app version.
Workflow
1. Check for an existing web session
test -f ~/.blitz/asc-agent/web-session.json && echo "SESSION_EXISTS" || echo "NO_SESSION"
- If
NO_SESSION: call theasc_web_authMCP tool first. Wait for it to complete before proceeding. - If
SESSION_EXISTS: proceed to the next step.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 252 lines · 59 tokens per session scan A cc0dce7e6e71
asc-iap-attach is a skill published in the GitHub repository blitzdotdev/blitz-mac (1,742 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 59 tokens to every session and 2,709 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
heimdall
Work with an Apple App Store Connect account through Heimdall's MCP servers — App Store listings and metadata, TestFlight builds and testers, subscription and in-app-purchase prices, customer reviews, sales and analytics reports, certificates and provisioning profiles. Use this whenever the user asks about their app…
appstore-ppp-pricing
Bulk-sets App Store in-app purchase and subscription prices across 175+ countries by purchasing power parity, using the appstore-ppp-prices CLI. Use whenever the user wants to localize, bulk-update, lower, raise or review regional App Store pricing — "set regional prices", "PPP pricing", "make my app cheaper in…
asc-revenuecat-catalog-sync
Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across ASC and RevenueCat.
onesub
Use this skill when the user wants to add in-app purchases (subscriptions, consumables, or non-consumables) to a React Native / Expo mobile app. onesub is the open-source server side of react-native-iap — one line of Express middleware validates Apple StoreKit 2 and Google Play Billing receipts. Pair it with the…
app-store-pricing
App Store pricing strategy, global equalization, subscription management, and regional pricing decisions using Apple's official 900-price-point system. Use when user asks about pricing tiers, IAP pricing, subscription pricing, regional pricing, price changes, App Store proceeds, base storefront selection, introductory…
apple-app-delivery
Upload builds, distribute on TestFlight, manage metadata, submit for Beta/App Review, and release on the App Store using Apple's official CLIs and the App Store Connect API. Handle exact or brief requests such as "upload this app to TestFlight" or "TestFlightにアップロードして" by deriving unambiguous repository and live Apple…