Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add moritouch/apple-app-delivery --skill apple-app-deliverygit clone --depth 1 https://github.com/moritouch/apple-app-deliveryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/moritouch/apple-app-delivery/apple-app-delivery)<a href="https://agentmods.dev/skills/moritouch/apple-app-delivery/apple-app-delivery"><img src="https://agentmods.dev/badge/skills/moritouch/apple-app-delivery/apple-app-delivery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/moritouch/apple-app-delivery/apple-app-delivery"><img src="https://agentmods.dev/badge/skills/moritouch/apple-app-delivery/apple-app-delivery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.08597 |
| Opus 5 | $0.00063 | $0.04299 |
| Sonnet 5 | $0.00025 | $0.01719 |
| Haiku 4.5 | $0.00013 | $0.00860 |
Grade A, and why
apple-app-delivery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 618 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Apple App Delivery
This changes production data at Apple. Read and plan first. For stable Xcode, default to
APP_STORE: stage the build in TestFlight first, then keep the same verified build eligible
for a separately approved App Review and App Store release. Treat archive, upload,
metadata, external Beta Review, App Review submission, and public release as separate
approval gates. Select TESTFLIGHT_INTERNAL_ONLY only when the operator explicitly asks
for an internal-only build. That opt-in path may use the tightly bounded automation below;
it never authorizes external testing or App Store delivery.
Session start
Do this before reading anything else. It decides whether this is a first run or a resumed release, and it prevents asking the operator for values that can be derived.
1. Verify prerequisites
node --version
xcodebuild -version
node <skill-dir>/scripts/credential-check.mjs identity
node <skill-dir>/scripts/asc-api.mjs self-test
credential-check.mjs identity reports the resolved Key ID, Issuer ID, and key path
without printing key material. If it fails, setup is incomplete: name the missing piece,
point at the matching section of README.md, and stop. Never ask the operator to paste
key contents, and never create, move, or chmod a key on their behalf.
Once identity resolves, confirm the key file and basic API access.
node <skill-dir>/scripts/credential-check.mjs validate
node <skill-dir>/scripts/asc-api.mjs request GET \
'/v1/apps?limit=1&fields%5Bapps%5D=name%2CbundleId'
2. Determine whether a release is already in progress
Resolve a release manifest path from the conversation, repository release instructions,
or the deterministic private release directory selected for this release before asking
the operator. For a brief TestFlight or App Store delivery request with no manifest, follow
references/brief-testflight-request.md and create a new private manifest only after
checking the derived app/version/build against live Apple state. Ask for a path only when
there are multiple plausible resumable releases. This skill keeps no state of its own:
the manifest and the provenance receipt are the technical state. They never preserve
release authorization or an intended stop point. When resumed work has no current
conversation or repository instruction stating where to stop, ask before advancing beyond
the current phase; never infer permission from an APP_STORE scope.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +10 lines · +9 tokens per session 2b992faeff91
- 9d ago First seen · 608 lines · 116 tokens per session scan A b7e017684918
apple-app-delivery is a skill published in the GitHub repository moritouch/apple-app-delivery (2 stars, last pushed 6d ago), licensed MIT. It adds 125 tokens to every session and 8,597 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
ios-app-store-release
Use when preparing, archiving, uploading, or submitting iOS apps through App Store Connect. Covers xcodebuild archive/export, Fastlane deliver, altool/transporter fallback, TestFlight, review submission, App Privacy, export compliance, release safety, and slash commands such as /ios-release and /ios-grade.
apple-release-ops
The mechanics of shipping Apple apps. Use for ANY code signing error ("no signing certificate", "provisioning profile doesn't include...", "revoked certificate"), provisioning profiles, certificates, entitlements, capabilities, TestFlight (groups, expiry, feedback), App Store Connect, uploading builds, xcodebuild…
app-store-connect
This skill should be used when the user asks to "upload to App Store", "manage App Store Connect", "update app metadata", "upload screenshots", "set app description", "set keywords", "manage TestFlight", "add beta testers", "check app reviews", "respond to reviews", "submit for review", "set app pricing", "create…
flame-harness-submit
Phase 10 — upload store text metadata + categories via fastlane, then pause with exact manual steps for the final iOS review submission and Android production promotion.
rn-harness-submit
Phase 10 — Submit to App Store Connect (iOS) and Google Play (Android). iOS fully automated, Android pauses for manual steps.