Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add duceum/appstore-ppp-pricing-agent-skill --skill appstore-ppp-pricinggit clone --depth 1 https://github.com/duceum/appstore-ppp-pricing-agent-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/duceum/appstore-ppp-pricing-agent-skill/appstore-ppp-pricing)<a href="https://agentmods.dev/skills/duceum/appstore-ppp-pricing-agent-skill/appstore-ppp-pricing"><img src="https://agentmods.dev/badge/skills/duceum/appstore-ppp-pricing-agent-skill/appstore-ppp-pricing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/duceum/appstore-ppp-pricing-agent-skill/appstore-ppp-pricing"><img src="https://agentmods.dev/badge/skills/duceum/appstore-ppp-pricing-agent-skill/appstore-ppp-pricing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 28 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 52 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Agent Snooping · line 188 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.02239 |
| Opus 5 | $0.00057 | $0.01120 |
| Sonnet 5 | $0.00023 | $0.00448 |
| Haiku 4.5 | $0.00012 | $0.00224 |
Grade A, and why
appstore-ppp-pricing scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://raw.githubusercontent.com/duceum/appstore-ppp-pricing-agent-skill/main/agent-skills/claude-code/appstore-ppp-pricing/SKILL.md \ How it starts
The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App Store PPP pricing
Sets per-country App Store prices from a US base price, scaled by purchasing power. The tool is a local CLI — the App Store Connect key stays on the user's machine.
Before anything else
Check the tool is installed:
ppp-pricing --version
Not installed → uv tool install appstore-ppp-prices (or pipx install appstore-ppp-prices).
First-run setup
If any command reports Missing App Store Connect credentials, walk the user through
this. It is the usual blocker and it is a one-time cost.
The tool needs an App Store Connect API key with pricing permissions. Only the user can create one — it is behind their Apple account:
- Open https://appstoreconnect.apple.com/access/integrations/api
- Generate API Key, access level Admin or App Manager
- Copy the Key ID (10 characters) and the Issuer ID (the UUID at the top)
- Download the
.p8file — Apple allows this exactly once
Then prepare the config directory for them:
mkdir -p ~/.config/ppp-pricing
Ask the user to move the downloaded key there themselves and to fill in the values:
mv ~/Downloads/AuthKey_XXXXXXXXXX.p8 ~/.config/ppp-pricing/
You may create ~/.config/ppp-pricing/.env as a template with empty values for
ASC_KEY_ID, ASC_ISSUER_ID and ASC_PRIVATE_KEY_PATH (plus optional
LLM_API_KEY), and explain what goes in each. ASC_PRIVATE_KEY_PATH is just the
.p8 filename — it resolves next to the .env.
Do not ask the user to paste key material into the chat, do not read the .p8 back,
and do not echo the contents of .env. The user fills in the values; you never see them.
Confirm setup worked by listing products, which is read-only:
ppp-pricing --app-id 123456789
Alternative config locations, if the user wants one: --config /path/to/dir, the
PPP_PRICING_CONFIG environment variable, or a .env in the working directory.
The one rule that matters
Never run an apply without showing the user a dry run first and getting an explicit yes. This command changes what real customers are charged, in up to 174 territories, and there is no undo. A price change is visible to users and, for subscriptions, can trigger churn and Apple's own price-consent flows.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 215 lines · 115 tokens per session scan A 14c9125a1fc4
appstore-ppp-pricing is a skill published in the GitHub repository duceum/appstore-ppp-pricing-agent-skill (46 stars, last pushed 19d ago), licensed MIT. It adds 115 tokens to every session and 2,239 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
asc-subscription-localization
Bulk-localize subscription, subscription-group, and in-app purchase display names across App Store locales using asc, including API 4.4.1 version-scoped v2 resources. Use when filling or updating subscription/IAP names and descriptions without App Store Connect UI work.
ios-marketing-capture
Use when the user wants to automate capture of marketing screenshots for a SwiftUI iOS app across multiple locales, devices, or appearances. Covers full-screen shots, isolated element renders (carousel cards, widgets), and reproducible output naming. Triggers on marketing screenshots, locale screenshots, widget…
asc-app-create-ui
Create an App Store Connect app via iris API using web session from Blitz.
iap-finalizer
Take a one-time in-app purchase from MISSINGMETADATA to READYTOSUBMIT in App Store Connect — set its price schedule and localized display name/description (and optional review screenshot) via the ASC REST API. Use at Phase 6 (Pre-Release), after the IAP is built in-app (Phase 4) and its ASC record exists. NOT for…
b2c-localization
Add translations and multi-language support to B2C Commerce storefronts. Use this skill whenever the user needs to translate a storefront, add a new locale, create or edit .properties resource bundles, display translated strings in templates, format dates or currencies for different regions, or build a language…
sfnext-i18n
Implement internationalization in Storefront Next using i18next with useTranslation for components and getTranslation for server-side code. Use when adding translations, configuring locales, handling pluralization, using the Zod schema factory pattern, or managing extension translations. Covers namespaces…