Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cruisediary/apple-app-review-skills --skill data-minimization-auditgit clone --depth 1 https://github.com/cruisediary/apple-app-review-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cruisediary/apple-app-review-skills/data-minimization-audit)<a href="https://agentmods.dev/skills/cruisediary/apple-app-review-skills/data-minimization-audit"><img src="https://agentmods.dev/badge/skills/cruisediary/apple-app-review-skills/data-minimization-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cruisediary/apple-app-review-skills/data-minimization-audit"><img src="https://agentmods.dev/badge/skills/cruisediary/apple-app-review-skills/data-minimization-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01617 |
| Opus 5 | $0.00020 | $0.00809 |
| Sonnet 5 | $0.00008 | $0.00323 |
| Haiku 4.5 | $0.00004 | $0.00162 |
Grade A, and why
data-minimization-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Data Minimization Audit
Purpose
Detects data collection patterns that exceed what is necessary for the app's stated functionality, enforcing Guideline 5.1.1(iii) data minimization requirements.
Apple Guideline
- Primary: 5.1.1(iii) — Data Collection and Storage: Data Minimization
- Related: 5.1.1(ii), 5.1.2
- Reference:
references/guidelines/5-legal.md
Real-World Rejection Cases
- Case: App requested full photo library access just to let user pick a profile picture — rejected Source: Apple Developer Forums Root cause: PHPickerViewController gives access without requiring NSPhotoLibraryUsageDescription — full access not needed for single selection; Apple reviewers specifically look for this pattern
Trigger
Invoke on any iOS/macOS project to identify permission requests and data collection calls that can be replaced with privacy-preserving alternatives.
Inputs
| Name | Type | Default | Description |
|---|---|---|---|
project_root |
path | cwd | iOS/macOS project root |
shared_context |
object | nil | Pre-collected context from appstore-full-audit Phase 1 |
Actions
Phase 1: Context Collection
Skip this phase if shared_context is provided.
Glob**/*.swift— collect all Swift source files.Glob**/*.m— collect Objective-C source files.Glob**/*.entitlements— locate entitlements files for background location check.Glob**/PrivacyInfo.xcprivacy— locate privacy manifest for identifier declaration check.
Phase 2: Checks
- Full photo library access for selection use case
GreppatternPHPhotoLibrary.*requestAuthorization.*readWritein**/*.swift. If found, alsoGrepPHPickerViewController— if picker not used, flag → 🟠 HIGH. PHPickerViewController provides privacy-preserving photo selection without full library authorization; developers should migrate to this API for profile photo or single-image selection flows.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 132 lines · 41 tokens per session scan A 0caaaa658c85
data-minimization-audit is a skill published in the GitHub repository cruisediary/apple-app-review-skills (16 stars, last pushed 4mo ago), licensed MIT. It adds 41 tokens to every session and 1,617 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
benchmark
Run performance + quality benchmarks. ASR reports WER, RTF, process memory, and throughput across engines/variants. Arguments include asr, tts, vad, diarize, asr-quick.
review-pr
Review a pull request for conceptual fit, architecture impact, adversarial failure modes, security risk, docs impact, regression risk, test coverage, and merge readiness. Use when asked to review a PR, check whether a PR is safe to merge, decide if more tests are needed, perform adversarial or security review, or…
boutique-best-practices
Best practices for using Boutique with Swift 6 concurrency, @Observable, @ObservationIgnored, Sendable conformance, testing with preview stores, and dependency injection. Use when troubleshooting Boutique issues, migrating to Swift 6, or setting up tests.
boutique-store
Create and use Boutique Store for Swift data persistence, including initialization, @Stored controllers, CRUD operations, operation chaining, and granular event monitoring. Use when persisting arrays of items, building data controllers, or working with Boutique's Store type.
boutique-stored-values
Persist individual values with Boutique's @StoredValue (UserDefaults) and @SecurelyStoredValue (Keychain), including set, reset, toggle, bindings, keypath setters, array and dictionary helpers, and async observation. Use when storing preferences, settings, feature flags, or sensitive data like auth tokens.
boutique-swiftui
Integrate Boutique with SwiftUI views using onChange, onStoreDidLoad, bindings, and preview stores. Use when building SwiftUI views that display or react to Boutique-persisted data.