Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lukedj78/dev-flow/rn-publishing-paymentsnpx skills add lukedj78/dev-flow --skill rn-publishing-paymentsgit clone --depth 1 https://github.com/lukedj78/dev-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukedj78/dev-flow/rn-publishing-payments)<a href="https://agentmods.dev/skills/lukedj78/dev-flow/rn-publishing-payments"><img src="https://agentmods.dev/badge/skills/lukedj78/dev-flow/rn-publishing-payments.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.00933 |
| Opus 5 | $0.00066 | $0.00466 |
| Sonnet 5 | $0.00026 | $0.00187 |
| Haiku 4.5 | $0.00013 | $0.00093 |
Grade A, and why
rn-publishing-payments scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
rn-publishing-payments — guardrail for store publishing + payments
For the current Expo API and per-version details, verify against the Expo docs / MCP
mcp.expo.dev/expo/skills(see rn-fundamentals → Source of truth).
The 5 rules (non-negotiable)
- Apple's 30% rule: ANY digital good/service consumed inside the app MUST go through IAP (subscriptions, premium tiers, in-app currency, unlock-feature one-shots) — unless an allowed external-purchase path applies (notably the US external-link rule since May 2025; see
references/decision-tree.mdQ2). Bypassing IAP without an allowed path = rejection under guideline 3.1.1. - Stripe / external payment only for NON-digital: physical goods (shipped), services rendered outside the app (ride, food delivery, classroom), B2B (consultant invoice). Even then, Apple's "anti-steering" rules apply — careful what you link.
- Use RevenueCat for IAP, not raw
react-native-iap. RevenueCat handles receipt validation, cross-platform subscriptions, restore-purchases, sandbox testing, and analytics in one SDK with a generous free tier. Raw IAP works but you'll write 10x the code. - Screenshots must be REAL screenshots of the running app, not marketing illustrations (guideline 2.3.10). iOS needs one iPhone size — 6.9" (preferred) or 6.5" — plus 13" iPad only if you ship iPad; Apple scales the rest down (see
references/store-assets.md). - Privacy nutrition label (iOS) + Data safety (Android) MUST match reality. Lying about data collection = ban. Audit the SDKs you use (analytics, push, crash reporting) — each declares what it collects.
Quick decision tree
- "IAP, Stripe, or external link?" →
references/decision-tree.md - "What assets do I need for the store?" →
references/store-assets.md - "How do I integrate RevenueCat?" →
references/revenuecat.md - "What about App Store review?" →
references/review-guidelines.md
Common anti-patterns (NEVER do)
- ❌ "Buy premium" button that opens Stripe Checkout in a WebView for an in-app subscription → rejection.
- ❌ "Already paid on the web? Sign in to unlock" → tolerated under specific conditions (reader app exemption, multi-platform service), but read the rules first.
- ❌ Hardcoded
"€4.99/month"in the UI — useproduct.priceStringfrom RevenueCat / StoreKit (localized currency, tax-included for EU). - ❌ Skipping Sign in with Apple when offering Google sign-in (iOS) → 4.8 reject.
- ❌ Marketing screenshots with fake content or device frames not provided by Apple → 2.3 reject.
- ❌ Privacy nutrition label that says "no data collected" while you ship Firebase Analytics → ban risk.
- ❌ Asking for IDFA (ATT prompt) before showing app value → bad practice + low opt-in rate.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 42 lines · 131 tokens per session scan A 286044cb415a
rn-publishing-payments is a skill published in the GitHub repository lukedj78/dev-flow (6 stars, last pushed yesterday), licensed MIT. It adds 131 tokens to every session and 933 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
revenuecat
Integrate RevenueCat for in-app purchases — consumable credit packs or subscriptions. Use when setting up RevenueCat, creating products in App Store Connect / Google Play, configuring the SDK, building a paywall, or handling purchase webhooks in Supabase Edge Functions.
in-app-purchases
Reference for in-app purchases and subscriptions in React Native apps, with RevenueCat as the integration layer. Use when implementing paywalls or subscriptions, when sandbox purchases behave strangely, when premium status does not arrive after purchase, when webhooks need verification, or when restore and transfer…
agent-app-store
Agent skill for app-store - invoke with $agent-app-store.
google-play
Google Play Developer API (Android Publisher) integration with managed OAuth. Manage apps, subscriptions, in-app purchases, and reviews. Use this skill when users want to interact with Google Play Console programmatically. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
asc-iap-attach
Attach in-app purchases and subscriptions to an app version for App Store review. Use when the user has IAPs or subscriptions in "Ready to Submit" state that need to be included with a first-time version submission. Works for both first-time and subsequent submissions.
asc-ppp-pricing
Set territory-specific pricing for subscriptions and in-app purchases using current asc setup, pricing summary, price import, and price schedule commands. Use when adjusting prices by country or implementing localized PPP strategies.