Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cruisediary/apple-app-review-skills --skill privacy-manifest-checkgit clone --depth 1 https://github.com/cruisediary/apple-app-review-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cruisediary/apple-app-review-skills/privacy-manifest-check)<a href="https://agentmods.dev/skills/cruisediary/apple-app-review-skills/privacy-manifest-check"><img src="https://agentmods.dev/badge/skills/cruisediary/apple-app-review-skills/privacy-manifest-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cruisediary/apple-app-review-skills/privacy-manifest-check"><img src="https://agentmods.dev/badge/skills/cruisediary/apple-app-review-skills/privacy-manifest-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.02128 |
| Opus 5 | $0.00022 | $0.01064 |
| Sonnet 5 | $0.00009 | $0.00426 |
| Haiku 4.5 | $0.00004 | $0.00213 |
Grade A, and why
privacy-manifest-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Privacy Manifest Check
Purpose
Detects missing or incomplete PrivacyInfo.xcprivacy privacy manifest files, enforcing Guideline 5.1 and Apple's required-reason API declaration policy enforced from May 1, 2024.
Apple Guideline
- Primary: 5.1 — Privacy: Data Collection and Storage
- Related: 5.1.1(ii)
- Reference:
references/guidelines/5-legal.md
Real-World Rejection Cases
-
Case: Received ITMS-91053 email: "Missing API declaration" — app used UserDefaults without PrivacyInfo.xcprivacy declaring reason CA92.1 Source: https://developer.apple.com/documentation/bundleresources/privacy-manifest-files — enforced May 1, 2024 Root cause: All apps using required reason APIs must declare them in PrivacyInfo.xcprivacy; Apple's automated pipeline scans submitted binaries and issues ITMS-91053 rejection emails for missing declarations
-
Case: App using Firebase Performance SDK received ITMS-91053 for
mach_absolute_time— Firebase Performance uses it internally to measure timing but the app's PrivacyInfo.xcprivacy did not declare NSPrivacyAccessedAPICategorySystemBootTime Source: firebase-ios-sdk GitHub issue #12557 Root cause: Firebase Performance SDK calls mach_absolute_time internally; apps must declare NSPrivacyAccessedAPICategorySystemBootTime with reason 35F9.1 even if the app code does not call mach_absolute_time directly — the SDK call counts -
Case: Flutter app using Datadog SDK received ITMS-91053 — Datadog's dd-sdk-flutter used required-reason APIs but had not yet shipped a PrivacyInfo.xcprivacy in that SDK version Source: dd-sdk-flutter GitHub issue #587 Root cause: Third-party SDKs must each ship their own PrivacyInfo.xcprivacy; if an SDK version predates the May 2024 enforcement, the app team must upgrade to an SDK version that includes a privacy manifest or add the declarations to the app-level manifest
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 150 lines · 44 tokens per session scan A 7237736982b4
privacy-manifest-check is a skill published in the GitHub repository cruisediary/apple-app-review-skills (16 stars, last pushed 4mo ago), licensed MIT. It adds 44 tokens to every session and 2,128 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
benchmark
Run performance + quality benchmarks. ASR reports WER, RTF, process memory, and throughput across engines/variants. Arguments include asr, tts, vad, diarize, asr-quick.
review-pr
Review a pull request for conceptual fit, architecture impact, adversarial failure modes, security risk, docs impact, regression risk, test coverage, and merge readiness. Use when asked to review a PR, check whether a PR is safe to merge, decide if more tests are needed, perform adversarial or security review, or…
boutique-best-practices
Best practices for using Boutique with Swift 6 concurrency, @Observable, @ObservationIgnored, Sendable conformance, testing with preview stores, and dependency injection. Use when troubleshooting Boutique issues, migrating to Swift 6, or setting up tests.
boutique-store
Create and use Boutique Store for Swift data persistence, including initialization, @Stored controllers, CRUD operations, operation chaining, and granular event monitoring. Use when persisting arrays of items, building data controllers, or working with Boutique's Store type.
boutique-stored-values
Persist individual values with Boutique's @StoredValue (UserDefaults) and @SecurelyStoredValue (Keychain), including set, reset, toggle, bindings, keypath setters, array and dictionary helpers, and async observation. Use when storing preferences, settings, feature flags, or sensitive data like auth tokens.
boutique-swiftui
Integrate Boutique with SwiftUI views using onChange, onStoreDidLoad, bindings, and preview stores. Use when building SwiftUI views that display or react to Boutique-persisted data.