Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cruisediary/apple-app-review-skills --skill att-framework-auditgit clone --depth 1 https://github.com/cruisediary/apple-app-review-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cruisediary/apple-app-review-skills/att-framework-audit)<a href="https://agentmods.dev/skills/cruisediary/apple-app-review-skills/att-framework-audit"><img src="https://agentmods.dev/badge/skills/cruisediary/apple-app-review-skills/att-framework-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cruisediary/apple-app-review-skills/att-framework-audit"><img src="https://agentmods.dev/badge/skills/cruisediary/apple-app-review-skills/att-framework-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01627 |
| Opus 5 | $0.00023 | $0.00813 |
| Sonnet 5 | $0.00009 | $0.00325 |
| Haiku 4.5 | $0.00005 | $0.00163 |
Grade A, and why
att-framework-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: ATT Framework Audit
Purpose
Detects analytics or tracking SDKs present without the required App Tracking Transparency prompt, enforcing Guideline 5.1.2(i) which requires user consent before any cross-app or cross-site tracking.
Apple Guideline
- Primary: 5.1.2(i) — Privacy: Data Use and Sharing — Tracking
- Related: 5.1.1(ii)
- Reference:
references/guidelines/5-legal.md
Real-World Rejection Cases
-
Case: App using Firebase Analytics without ATT prompt — rejected for tracking without consent Source: Apple Developer Forums Root cause: Any cross-app/cross-site tracking requires ATTrackingManager.requestTrackingAuthorization before data collection — Firebase Analytics links events to a device-level identifier that crosses app boundaries when user has not consented
-
Case: After an app update, users reported the ATT permission dialog appeared on every launch — caused by prior binary's tracking metadata conflicting with the updated app build — Apple rejected the update after tester reproduction Source: Apple Developer Forums thread/679585 Root cause: ATTrackingManager authorization state can become inconsistent when the prior production binary's metadata conflicts with the current build; always test ATT prompt behavior both on fresh install and on update from the live App Store binary before submission
Trigger
Invoke on any iOS/macOS project that integrates analytics, attribution, or advertising SDKs to verify ATT consent flow is present.
Inputs
| Name | Type | Default | Description |
|---|---|---|---|
project_root |
path | cwd | iOS/macOS project root |
shared_context |
object | nil | Pre-collected context from appstore-full-audit Phase 1 |
Actions
Phase 1: Context Collection
Skip this phase if shared_context is provided.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 132 lines · 45 tokens per session scan A d49f4f106d91
att-framework-audit is a skill published in the GitHub repository cruisediary/apple-app-review-skills (16 stars, last pushed 4mo ago), licensed MIT. It adds 45 tokens to every session and 1,627 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
benchmark
Run performance + quality benchmarks. ASR reports WER, RTF, process memory, and throughput across engines/variants. Arguments include asr, tts, vad, diarize, asr-quick.
review-pr
Review a pull request for conceptual fit, architecture impact, adversarial failure modes, security risk, docs impact, regression risk, test coverage, and merge readiness. Use when asked to review a PR, check whether a PR is safe to merge, decide if more tests are needed, perform adversarial or security review, or…
boutique-best-practices
Best practices for using Boutique with Swift 6 concurrency, @Observable, @ObservationIgnored, Sendable conformance, testing with preview stores, and dependency injection. Use when troubleshooting Boutique issues, migrating to Swift 6, or setting up tests.
boutique-store
Create and use Boutique Store for Swift data persistence, including initialization, @Stored controllers, CRUD operations, operation chaining, and granular event monitoring. Use when persisting arrays of items, building data controllers, or working with Boutique's Store type.
boutique-stored-values
Persist individual values with Boutique's @StoredValue (UserDefaults) and @SecurelyStoredValue (Keychain), including set, reset, toggle, bindings, keypath setters, array and dictionary helpers, and async observation. Use when storing preferences, settings, feature flags, or sensitive data like auth tokens.
boutique-swiftui
Integrate Boutique with SwiftUI views using onChange, onStoreDidLoad, bindings, and preview stores. Use when building SwiftUI views that display or react to Boutique-persisted data.