Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add markdavidgan/apple-dev-skills --skill submission-preflightgit clone --depth 1 https://github.com/markdavidgan/apple-dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/markdavidgan/apple-dev-skills/submission-preflight)<a href="https://agentmods.dev/skills/markdavidgan/apple-dev-skills/submission-preflight"><img src="https://agentmods.dev/badge/skills/markdavidgan/apple-dev-skills/submission-preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/markdavidgan/apple-dev-skills/submission-preflight"><img src="https://agentmods.dev/badge/skills/markdavidgan/apple-dev-skills/submission-preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01846 |
| Opus 5 | $0.00050 | $0.00923 |
| Sonnet 5 | $0.00020 | $0.00369 |
| Haiku 4.5 | $0.00010 | $0.00185 |
Grade A, and why
submission-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Submission Preflight
Catch the rejection before Apple does. This is the adversarial pass you run before asc-submission submits — it simulates App Review and finds the guideline violations that cost you a 1–3 day rejection cycle each. Build/upload mechanics live in asc-build-check and asc-submission; privacy-manifest specifics live in privacy-manifest; this skill is the will-it-pass-review gate.
App Review rejects on patterns, not vibes. The rejection reasons cluster into six buckets, and each app type adds its own. This skill checks the universal buckets, then loads the rule pack for the app's type.
How to run a preflight
- Run
asc-auditfirst, and do not submit on this skill's pass alone. This engine checks guideline-compliance risk in the content App Review would see; it says nothing about whether that content is still current. A rejected submission whose local docs still claimWAITING_FOR_REVIEW, review notes that still name a build number several versions old, or a disclosure paragraph that exists locally but was never pushed to the live ASC field are none of them compliance-pack findings — a preflight pass that skipped the drift check reports clean and lets a stale submission go out anyway. Submit only on a preflight pass and a drift check with no unresolved findings. - Identify the app type — pick the closest from the table below. An app can match several; load each relevant pack.
- Pull live state via the App Store Connect MCP:
asc_get_app_info,asc_get_metadata(name/subtitle/description/keywords/URLs),asc_get_privacy(nutrition label),asc_get_age_rating,asc_list_iaps/asc_list_subscriptions,asc_check_submission(what's blocking right now). If MCP access isn't configured, ask the user to paste each field. - Run the universal rule packs (
references/rule-*.md) — six buckets, every app. - Run the app-type pack(s) (
references/type-*.md). - Report as a triaged checklist: ❌ will-reject / ⚠️ likely-flag / ✅ clear — each with the guideline number and the concrete fix.
- Hand off: privacy-manifest gaps →
privacy-manifest; if already rejected →app-rejection-recovery; listing/keyword issues →asc-aso.
What ships with it
16 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/rule-design.md 11 KB
- references/rule-entitlements.md 8.9 KB
- references/rule-metadata.md 8.1 KB
- references/rule-privacy.md 7.8 KB
- references/rule-subscription.md 11 KB
- references/type-ai-apps.md 8.3 KB
- references/type-all-apps.md 5.6 KB
- references/type-crypto-finance.md 8.0 KB
- references/type-games.md 7.3 KB
- references/type-health-fitness.md 9.0 KB
- references/type-kids.md 8.5 KB
- references/type-macos.md 7.3 KB
- references/type-social-ugc.md 8.0 KB
- references/type-subscription-iap.md 11 KB
- references/type-vpn-utility.md 11 KB
- templates/overlay-template.md 1.7 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 102 lines · 100 tokens per session scan A 993a0168dc0a
submission-preflight is a skill published in the GitHub repository markdavidgan/apple-dev-skills (5 stars, last pushed 10d ago), licensed MIT. It adds 100 tokens to every session and 1,846 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
asc-revenuecat-catalog-sync
Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across ASC and RevenueCat.
asc-localize-metadata
Automatically translate and sync App Store metadata (description, keywords, what's new, subtitle) to multiple languages using LLM translation and asc CLI. Use when asked to localize an app's App Store listing, translate app descriptions, or add new languages to App Store Connect.
asc-shots-pipeline
Orchestrate iOS screenshot automation with xcodebuild/simctl for build-run, AXe for UI actions, JSON settings and plan files, Koubou-based framing (asc screenshots frame), and screenshot upload (asc screenshots upload). Use when users ask for automated screenshot capture, AXe-driven simulator flows, frame composition…
asc-metadata-sync
Sync, validate, and apply App Store metadata with the current asc canonical metadata workflow. Use when updating metadata, localizations, keywords, or migrating legacy fastlane metadata.
asc-release-flow
Orchestrate App Store releases with asc, including staging a version, uploading or building an artifact, publishing, and submitting for review. Use when the user wants to prepare or execute a release. Keep Game Center item preparation in this skill; route other readiness failures, stuck submissions, cancellation, and…
asc-submission-health
Diagnose App Store submission blockers and operate review health with asc, including readiness validation, repair routing, status monitoring, cancellation, and retry decisions. Use when validation fails, a version is not in a valid state, review status is unclear or stuck, or a failed submission must be repaired and…