Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add The-Artificer-of-Ciphers-LLC/skills-from-the-artificer --skill testflight-publishgit clone --depth 1 https://github.com/The-Artificer-of-Ciphers-LLC/skills-from-the-artificerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/the-artificer-of-ciphers-llc/skills-from-the-artificer/testflight-publish)<a href="https://agentmods.dev/skills/the-artificer-of-ciphers-llc/skills-from-the-artificer/testflight-publish"><img src="https://agentmods.dev/badge/skills/the-artificer-of-ciphers-llc/skills-from-the-artificer/testflight-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/the-artificer-of-ciphers-llc/skills-from-the-artificer/testflight-publish"><img src="https://agentmods.dev/badge/skills/the-artificer-of-ciphers-llc/skills-from-the-artificer/testflight-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00113 | $0.01631 |
| Opus 5.5 | $0.00045 | $0.00652 |
| Sonnet 5.5 | $0.00023 | $0.00326 |
| Haiku 4.5 | $0.00011 | $0.00163 |
Grade A, and why
testflight-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TestFlight Publish
Chains the TestFlight pipeline into one flow: verify app state, prepare What to Test notes, build and upload, wait for processing, distribute to beta groups, then verify the result.
This skill contains no credentials or app identifiers. Everything app-specific comes from your environment or project config.
Configuration (do this once)
Set these as environment variables (shell profile, CI secret store, or a git-ignored .env). Never commit them and never paste them into chat or notes.
| Variable | Meaning |
|---|---|
ASC_KEY_ID |
App Store Connect API key ID |
ASC_ISSUER_ID |
App Store Connect API issuer ID |
ASC_KEY_PATH |
Path to the API private key file (keep it outside the repo) |
BUNDLE_ID |
Your app's bundle identifier, <your.bundle.id> |
APP_ID |
Numeric App Store Connect app ID, <APP_ID> (resolve it in Phase 1 if unset) |
If any are missing, stop and ask the user to configure them. Do not guess values or search the machine for keys.
Also needed: a way to build and upload. Either your project's own build script (referred to below as "your build script"), the asc CLI (asc publish, see the asc-release-flow skill), or plain xcodebuild archive + xcodebuild -exportArchive (see asc-xcode-build).
Procedure
Phase 1: Pre-flight verification
- Resolve the app:
asc apps listfiltered by$BUNDLE_ID(seeasc-id-resolver), or the ASC MCP equivalent if connected. Capture the app ID as$APP_ID. - List beta groups for the app and the tester count per group (
asc-testflight-orchestration). Keep calls lean; avoid fetching full metadata. - Read the current local build number from the project (for example
agvtool what-version, orCURRENT_PROJECT_VERSIONin the project file or xcconfig). - Run pre-flight checks: clean or intentionally dirty git tree, signing identity and provisioning profile valid, required tests pass, version and build number higher than the latest uploaded build.
- Report: local version and build number, beta groups with tester counts, any warnings.
- If the app is not found or no beta groups exist, STOP and report. Do not build.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 136 lines · 113 tokens per session scan A 97e92d4f57fb
testflight-publish is a skill published in the GitHub repository The-Artificer-of-Ciphers-LLC/skills-from-the-artificer (6 stars, last pushed yesterday), licensed MIT. It adds 113 tokens to every session and 1,631 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-15.
Other skills, from other repositories
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component…
android-dev
Production-grade Android app development guide covering native (Kotlin/Java), cross-platform (Flutter, RN, KMM), and hybrid architectures.
flutter
Use when building Flutter applications. Covers widget composition, state management, build-method performance, platform channels, and the rendering behavior behind most Flutter jank. Trigger on "my flutter app is janky", "too many rebuilds", "riverpod or bloc", "call native code from flutter". Do not use for store…
ios
Use when building native iOS applications. Covers SwiftUI architecture, state management, navigation, networking, persistence, background behavior, and App Store submission requirements. Trigger on "structure my swiftui app", "deep links open the wrong screen", "background fetch isn't running". Do not use for Swift…
mobile-release
Use when preparing a mobile app for release. Covers versioning, signing, staged rollout, crash monitoring, store review requirements, and rollback when an update goes wrong. Trigger on "ready to submit to the app store", "app got rejected in review", "crash rate spiked after the update", "set up a staged rollout". Do…
react-native
Use when building cross-platform mobile apps with React Native or Expo. Covers navigation, platform differences, list performance, native modules, offline behavior, and release builds. Trigger on "flatlist is laggy", "expo or bare react native", "bridge to a native module", "set up ota updates". Do not use for web…