Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add moritouch/apple-app-delivery --skill apple-app-deliverygit clone --depth 1 https://github.com/moritouch/apple-app-deliveryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/moritouch/apple-app-delivery/apple-app-delivery)<a href="https://agentmods.dev/skills/moritouch/apple-app-delivery/apple-app-delivery"><img src="https://agentmods.dev/badge/skills/moritouch/apple-app-delivery/apple-app-delivery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/moritouch/apple-app-delivery/apple-app-delivery"><img src="https://agentmods.dev/badge/skills/moritouch/apple-app-delivery/apple-app-delivery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00838 |
| Opus 5.5 | $0.00017 | $0.00335 |
| Sonnet 5.5 | $0.00008 | $0.00168 |
| Haiku 4.5 | $0.00004 | $0.00084 |
Grade A, and why
apple-app-delivery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Apple App Delivery
依頼されたアプリ・工程・停止点を先に特定し、現在の会話で得た承認の範囲で進める。リポジトリの配信手順とライブ状態から導出できる値は質問しない。パスはこのスキルのルート基準。
必要な経路だけを読む
| 依頼・状態 | 参照 |
|---|---|
| 短いTestFlight配信依頼・対象の解決 | brief-testflight-request |
| 初回・manifest未確定・再開 | 開始と対象解決 |
| 認証・接続の初期設定、前提不足 | setup |
| app record、署名、capability、テスターの変更 | provisioning |
| ビルド・upload | preflight、archive/upload |
| TestFlight配信・利用可能状態の確認 | TestFlight |
| App Review・本番公開 | App Store、metadata |
| beta Xcode、TestFlight限定scope | prerelease |
| 明示的な内部限定配信の一括依頼 | internal automation |
| 失敗・upload結果不明・未完了receipt | failure runbook |
書き込みを含む工程では 安全境界と操作別gateを読む。単なる説明・ローカル資料の編集のために認証やAppleへの接続を始めない。
作業範囲と完了条件
- 通常はstable Xcodeと
APP_STOREを選び、TestFlight後に同じbuildをApp Storeへ進められるようにする。TESTFLIGHT_INTERNAL_ONLYは明示的な内部限定依頼だけ。scope自体は審査提出・公開の許可ではない。 - 現在の会話で既に依頼・承認されたarchive/upload等は、同じ許可を再度求めない。参照資料のapproval記述もこの境界で解釈する。未承認のmetadata・招待・外部審査・App Review・本番公開へ範囲を広げない。
- ツールのdry-run、対象の再取得、操作ごとの確認phraseと
planSha256は省略しない。対象・scope・停止点が変わる場合だけ未確定事項を確認する。 .p8・JWT・署名URL・秘密値をチャット／Gitへ出さない。アプリを表示名だけで特定せず、bundle ID・platform・version/buildを照合する。- uploadごとに非公開のprovenance receiptを保存する。結果不明のPOSTは再送せず照合し、receiptを書き換えない。契約・税務・privacy等の法的判断を推定しない。
- 「upload受付」「処理完了」「対象グループで利用可能」「実機確認済み」を区別する。完了報告から依頼に必要な証跡だけを示す。
What ships with it
36 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 390 B
- assets/app-store-localization.example.json 218 B
- assets/beta-app-localization.example.json 207 B
- assets/beta-build-localization.example.json 61 B
- assets/release-manifest.example.json 2.4 KB
- assets/review-detail.example.json 213 B
- assets/testflight-beta-manifest.example.json 1.9 KB
- assets/toolchain-acceptance-2026-08-18.json 1.7 KB
- references/app-store.md 2.8 KB
- references/archive-upload.md 4.1 KB
- references/brief-testflight-request.md 12 KB
- references/completion.md 877 B
- references/failure-runbook.md 7.4 KB
- references/internal-testflight-automation.md 6.3 KB
- references/metadata.md 3.7 KB
- references/operation-gates.md 4.2 KB
- references/preflight.md 2.2 KB
- references/prerelease-xcode.md 7.8 KB
- references/provisioning.md 4.2 KB
- references/safety-boundaries.md 2.7 KB
- references/session-start.md 11 KB
- references/setup.md 12 KB
- references/testflight.md 1.7 KB
- references/workflow.md 30 KB
- scripts/altool-upload.sh 27 KB runs code
- scripts/approval-plan.mjs 1.9 KB runs code
- scripts/artifact-digest.mjs 3.3 KB runs code
- scripts/asc-api.mjs 11 KB runs code
- scripts/asc-release.mjs 120 KB runs code
- scripts/asc-screenshots.mjs 20 KB runs code
- scripts/credential-check.mjs 3.7 KB runs code
- scripts/source-digest.mjs 3.7 KB runs code
- scripts/toolchain-policy.mjs 18 KB runs code
- scripts/upload-provenance.mjs 32 KB runs code
- scripts/validate-manifest.mjs 18 KB runs code
- scripts/xcode-upload.sh 41 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -583 lines · -83 tokens per session 920346654536
- 1mo ago Changed · +10 lines · +9 tokens per session 2b992faeff91
- 1mo ago First seen · 608 lines · 116 tokens per session scan A b7e017684918
apple-app-delivery is a skill published in the GitHub repository moritouch/apple-app-delivery (3 stars, last pushed 1mo ago), licensed MIT. It adds 42 tokens to every session and 838 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
ios-app-store-release
Use when preparing, archiving, uploading, or submitting iOS apps through App Store Connect. Covers xcodebuild archive/export, Fastlane deliver, altool/transporter fallback, TestFlight, review submission, App Privacy, export compliance, release safety, and slash commands such as /ios-release and /ios-grade.
apple-release-ops
The mechanics of shipping Apple apps. Use for ANY code signing error ("no signing certificate", "provisioning profile doesn't include...", "revoked certificate"), provisioning profiles, certificates, entitlements, capabilities, TestFlight (groups, expiry, feedback), App Store Connect, uploading builds, xcodebuild…
app-store-connect
This skill should be used when the user asks to "upload to App Store", "manage App Store Connect", "update app metadata", "upload screenshots", "set app description", "set keywords", "manage TestFlight", "add beta testers", "check app reviews", "respond to reviews", "submit for review", "set app pricing", "create…
flame-harness-submit
Phase 10 — upload store text metadata + categories via fastlane, then pause with exact manual steps for the final iOS review submission and Android production promotion.
rn-harness-submit
Phase 10 — Submit to App Store Connect (iOS) and Google Play (Android). iOS fully automated, Android pauses for manual steps.