Borrowing it
Nothing to install: this file belongs to erayendes/app-store-connect-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/erayendes/app-store-connect-mcp/main/.claude/skills/heimdall-contrib/SKILL.mdgit clone --depth 1 https://github.com/erayendes/app-store-connect-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/erayendes/app-store-connect-mcp/heimdall-contrib)<a href="https://agentmods.dev/skills/erayendes/app-store-connect-mcp/heimdall-contrib"><img src="https://agentmods.dev/badge/skills/erayendes/app-store-connect-mcp/heimdall-contrib/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/erayendes/app-store-connect-mcp/heimdall-contrib"><img src="https://agentmods.dev/badge/skills/erayendes/app-store-connect-mcp/heimdall-contrib.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.01704 |
| Opus 5 | $0.00056 | $0.00852 |
| Sonnet 5 | $0.00022 | $0.00341 |
| Haiku 4.5 | $0.00011 | $0.00170 |
Grade A, and why
heimdall-contrib scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Two files are the source of truth and nothing else is: spec/openapi.json
(Apple's, fetched) and spec/profiles.csv (hand-curated, the owner's
spreadsheet). Everything in src/generated/ is output.
Never edit src/generated/
Change the generator instead — scripts/generate.ts for operations and
descriptions, scripts/generate-profiles.ts for membership — then:
npm run generate
and commit the result. npm test and npm run typecheck must pass. A hand
edit under src/generated/ survives exactly until the next spec bump, and
disappears without a diff anyone will notice.
The one step that is easy to skip
When you improve an axis, lower its ceiling in tests/ax-audit.test.ts.
That file's own comment calls this "the whole maintenance burden", which is another way of saying it is the step that gets forgotten. The ceilings are ratchets: debt may shrink freely and may never grow, so a spec bump that adds forty endpoints carrying Apple's one-line summaries announces itself instead of landing quietly. Leaving a ceiling high after a real improvement does not fail anything — it silently converts the win into permanent slack, and the next regression hides inside it.
Read the current numbers with:
npm run ax:report
Curating a description is the highest-leverage change here
Descriptions are what a model reads when choosing among 982 tools, and roughly
700 are still Apple's own one-line summary. Add entries to CURATED in
scripts/describe.ts. What earns the space is what comes back, what narrows
it, and which neighbouring tool this one is not.
Two traps, both of which have actually happened and are recorded inline:
- Search matches tokens of three or more characters as substrings. A clause
written to say what a tool is not can hand it queries meant for something
else —
pinginside "stopping",outandreleaseinside "outside normal App Store releases". Name a neighbour by describing it, not by writing its tool name:app_screenshots__createinside a description made that tool the top hit for "create certificate". - Longer is not safer. Apple's short summaries are dense with the words
someone actually searches for. A more helpful sentence on
app_store_versions.build.setdiluted that and dropped the tool out of the top three for "select build for app store version"; it is deliberately uncurated now.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 143 lines · 111 tokens per session scan A 4245536130e4
heimdall-contrib is a skill published in the GitHub repository erayendes/app-store-connect-mcp (48 stars, last pushed yesterday), licensed MIT. It adds 111 tokens to every session and 1,704 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
merge-check
Xcode-specific pre-merge gate — archive build (catches strict-concurrency/MainActor errors debug builds miss), app-extension Info.plist check, SwiftLint — spawned in parallel. Trigger on Apple/Xcode merge intent specifically ("merge this iOS branch", "archive check before merge", "is this ready for TestFlight"); a…
apple-app-delivery
Upload builds, distribute on TestFlight, manage metadata, submit for Beta/App Review, and release on the App Store using Apple's official CLIs and the App Store Connect API. Default stable delivery to APPSTORE so one build can be tested in TestFlight and later submitted to the App Store; choose TESTFLIGHTINTERNALONLY…
apple-release-ops
The mechanics of shipping Apple apps. Use for ANY code signing error ("no signing certificate", "provisioning profile doesn't include...", "revoked certificate"), provisioning profiles, certificates, entitlements, capabilities, TestFlight (groups, expiry, feedback), App Store Connect, uploading builds, xcodebuild…
asc-workflow
Define, validate, and run repo-local multi-step automations with asc workflow and .asc/workflow.json. Use when migrating from lane tools, wiring CI pipelines, or orchestrating repeatable asc + shell release flows with hooks, conditionals, and sub-workflows.
app-store-changelog
Create user-facing App Store release notes by collecting and summarizing all user-impacting changes since the last git tag (or a specified ref). Use when asked to generate a comprehensive release changelog, App Store "What's New" text, or release notes based on git history or tags.