Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Dev869/swift-tothemax --skill apple-legal-maxgit clone --depth 1 https://github.com/Dev869/swift-tothemaxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dev869/swift-tothemax/apple-legal-max)<a href="https://agentmods.dev/skills/dev869/swift-tothemax/apple-legal-max"><img src="https://agentmods.dev/badge/skills/dev869/swift-tothemax/apple-legal-max/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dev869/swift-tothemax/apple-legal-max"><img src="https://agentmods.dev/badge/skills/dev869/swift-tothemax/apple-legal-max.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00235 | $0.03105 |
| Opus 5 | $0.00118 | $0.01553 |
| Sonnet 5 | $0.00047 | $0.00621 |
| Haiku 4.5 | $0.00023 | $0.00311 |
Grade A, and why
apple-legal-max scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Apple Legal Max — Legal & Privacy Compliance for Apple-Platform Apps
Everything a shipping Apple-platform app must have to be legally and policy-compliant: Apple's enforced privacy rules, the regulations that actually apply, and the documents the app needs. Cite the governing rule (App Review Guideline number or regulation article) for every requirement you state.
MANDATORY FRAMING — tell the user this once per conversation, early: "I'm not a lawyer and this isn't legal advice. This is engineering-grade compliance guidance based on Apple's published rules and the text of the regulations; have counsel review anything you'll actually publish or rely on — especially for kids' apps, health/financial data, or EU/regulated markets."
Fast-moving areas (EU DMA fees, US state age-verification laws, India DPDP) are marked [as of July 2026 — verify]. When one is load-bearing for the user's decision, re-verify against developer.apple.com before answering.
Reference files — load on demand
| File | Load when |
|---|---|
references/privacy-manifests.md |
PrivacyInfo.xcprivacy, required reason APIs, tracking domains, SDK manifests, nutrition-label aggregation |
references/regulations-for-apps.md |
GDPR, CCPA/US states, COPPA/kids, DPDP, EU DMA/DSA, export compliance & France |
references/document-templates.md |
Drafting privacy policy / ToS / EULA / subscription terms; where each URL goes in App Store Connect |
Compliance map — what applies when
Walk the app through these questions. Each "yes" pulls in obligations:
| Question | If YES, applies | Governing rules |
|---|---|---|
| Does the app (or any SDK in it) collect ANY data? | Privacy policy, accurate nutrition labels, privacy manifest data-type entries | Guideline 5.1.1(i), 5.1.2(i); App Privacy details |
| Does it track (link user/device data with third-party data for ads or share with data brokers)? | ATT prompt before tracking, NSPrivacyTracking=true, tracking domains declared, "Data Used to Track You" label |
Guideline 5.1.2; ATT framework docs |
| Account creation in-app? | In-app account deletion (not just deactivation), discoverable, initiates full deletion | Guideline 5.1.1(v) |
| Third-party/social login offered? | Must also offer Sign in with Apple or an equivalent privacy-focused option | Guideline 4.8 |
| Made for kids or targets children? | Kids Category rules, no third-party ads/analytics (narrow exceptions), COPPA (US), GDPR Art 8 (EU), parental gates | Guidelines 1.3, 5.1.4; COPPA Rule (amended, in force) |
| Auto-renewable subscriptions? | Full auto-renew disclosure in app + metadata, ToS/EULA link in app AND App Store metadata, privacy policy link | Guideline 3.1.2; state auto-renewal laws (CA ARL etc.) |
| Health, fitness, or medical data? | HealthKit rules, no ads from health data, research consent; HIPAA only if a covered entity/BA; WA My Health My Data | Guidelines 5.1.3, 1.4.1; RCW 19.373 |
| Uses ANY encryption (incl. HTTPS)? | Export compliance answer every build; France ANSSI declaration if non-exempt crypto and distributing in France | ITSAppUsesNonExemptEncryption; US EAR; French decree 2007-663 |
| Distributed in the EU? | GDPR, DSA trader status (mandatory since Feb 2025 — no trader status = removed from EU App Store), DMA options (alt marketplaces, web distribution, external purchase links) | GDPR; DSA Art 30/31; Apple DMA terms [as of July 2026 — verify fees] |
| Distributed in the US? | ~19–20 state comprehensive privacy laws in force (CA, VA, CO, CT, UT, TX, OR, MT, FL, DE, IA, NE, NH, NJ, TN, MN, MD, IN, KY, RI); GPC honoring in ~12 states | See regulations reference |
| Any SDK from Apple's "commonly used SDKs" list? | SDK must ship its own privacy manifest + signature | developer.apple.com third-party SDK requirements |
| User-generated content? | Moderation, blocking, reporting, contact info | Guideline 1.2 |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 126 lines · 235 tokens per session scan A 4871ab9abdb4
apple-legal-max is a skill published in the GitHub repository Dev869/swift-tothemax (7 stars, last pushed 2mo ago), licensed MIT. It adds 235 tokens to every session and 3,105 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ipaship-audit
Use when auditing iOS/Android app submissions for compliance with Apple App Store Review Guidelines or Google Play Developer Policies. Scan .ipa, .apk, or .zip files against official store policies, generate structured compliance reports, and identify violations with remediation steps.
app-store-review-guidelines
Route App Store submission-compliance tasks to the correct Knowledge Contracts — app completeness, demo accounts, screenshot/description accuracy, in-app purchase requirements, external payment link restrictions, restore purchases, minimum functionality, spam/duplicate-app avoidance, permission usage strings, privacy…
privacy
Route Privacy Manifest (PrivacyInfo.xcprivacy) implementation tasks to the correct Knowledge Contracts -- file structure/bundling, required-reason API declarations, collected data type declarations, and tracking domains/third-party SDK signatures. Use when writing or editing PrivacyInfo.xcprivacy…
account-deletion
Generates an Apple-compliant account deletion flow with multi-step confirmation UI, optional data export, configurable grace period, Keychain cleanup, and server-side deletion request. Use when user needs account deletion, right-to-delete, or Apple App Review compliance for account removal.
consent-flow
Generates GDPR/CCPA/DPDP privacy consent flows with granular category preferences, consent state persistence, audit logging, and ATT (App Tracking Transparency) integration. Use when user needs privacy consent UI, cookie/tracking consent, or compliance management.
app-store-approval
Audit an iOS/iPadOS codebase for App Store rejection risks before submission. Use this skill whenever the user mentions App Store submission, App Review, TestFlight release, app rejection, ITMS errors, privacy manifests, PrivacyInfo.xcprivacy, App Store guidelines, paywall compliance, "is my app ready to ship", or…