Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/raydeveloperf/app-store-connect-release-kit/asc-apinpx skills add raydeveloperF/App-Store-Connect-release-kit --skill asc-apigit clone --depth 1 https://github.com/raydeveloperF/App-Store-Connect-release-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00122 | $0.03485 |
| Opus 5 | $0.00061 | $0.01742 |
| Sonnet 5 | $0.00024 | $0.00697 |
| Haiku 4.5 | $0.00012 | $0.00348 |
Grade A, and why
asc-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 302 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ASC API
Use this skill to build or run local App Store Connect automation without exposing secrets to Codex, logs, repositories, or remote model context.
The default pattern is:
- Keep credentials outside every project in
~/.asc_secrets. - Keep the
.p8private key outside every project, such as under~/.ssh/. - Generate a 20-minute JWT only inside the local Python process.
- Send requests directly to
https://api.appstoreconnect.apple.com/. - Print only safe response summaries, never tokens or request headers.
Hard Security Rules
Never ask the user to paste ASC_KEY_ID, ASC_ISSUER_ID, .p8 contents, JWTs, or Authorization headers into chat.
Never run commands that reveal secrets, including:
cat ~/.asc_secretscat *.p8printenvenv- any command that prints
ASC_*,PRIVATE KEY,Bearer, orAuthorization
Never add real credentials to a project file, git-tracked file, script, fixture, markdown doc, shell history snippet, or test output.
Never print token, auth_headers, response.request.headers, PreparedRequest.headers, or full request dumps. On failures, print only:
- HTTP method and endpoint path
- status code
- response body text or JSON
- redacted diagnostics such as
Authorization: <redacted>
If authentication, signing, missing-file, missing-field, permission, or ASC 401/403 errors occur, tell the user to manually inspect ~/.asc_secrets and the .p8 path on their own machine. Explicitly state that Codex cannot and should not access the user's secret file, private key, JWT, or Authorization header.
For mutating live ASC operations (POST, PATCH, DELETE), confirm the target app/resource and intended changes with the user before executing. After generating final task JSON, stop and show it to the user. Do not upload or modify App Store Connect until the user explicitly confirms that final JSON. For read-only GET, proceed when the task is clear.
Local Credential File
Expect the user to create this file manually outside the project. If they have not done so yet, direct them to docs/asc-api-setup.md in the repository root for a complete step-by-step guide covering key generation, .p8 file storage, and setup verification.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 302 lines · 122 tokens per session scan A adb626c0ab11
asc-api is a skill published in the GitHub repository raydeveloperF/App-Store-Connect-release-kit (2 stars, last pushed 2mo ago), licensed MIT. It adds 122 tokens to every session and 3,485 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
asc-iap-attach
Attach in-app purchases and subscriptions to an app version for App Store review. Use when the user has IAPs or subscriptions in "Ready to Submit" state that need to be included with a first-time version submission. Works for both first-time and subsequent submissions.
asc-privacy-nutrition-labels
Set up App Store privacy nutrition labels (data collection declarations) for an app. Use when the user needs to declare what data their app collects, how it's used, and whether it's linked to the user. Handles both "no data collected" and full data collection declarations.
asc-team-key-create
Create a new App Store Connect Team API Key with Admin permissions, download the one-time .p8 private key, and store it in /.blitz. Use when the user needs a new ASC API key for CLI auth, CI/CD, or external tooling.
asc-app-create-ui
Create an App Store Connect app via iris API using web session from Blitz.
aso-playbook
Beginner-friendly App Store Optimization guide covering keyword research, screenshot design, rating management, and A/B testing for iOS and Android. By @WeiYipei — practical ASO for indie developers and small teams.
heimdall
Work with an Apple App Store Connect account through Heimdall's MCP servers — App Store listings and metadata, TestFlight builds and testers, subscription and in-app-purchase prices, customer reviews, sales and analytics reports, certificates and provisioning profiles. Use this whenever the user asks about their app…