Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vishalvshekkar/app-store-toolkit --skill auditgit clone --depth 1 https://github.com/vishalvshekkar/app-store-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vishalvshekkar/app-store-toolkit/audit)<a href="https://agentmods.dev/skills/vishalvshekkar/app-store-toolkit/audit"><img src="https://agentmods.dev/badge/skills/vishalvshekkar/app-store-toolkit/audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01194 |
| Opus 5 | $0.00032 | $0.00597 |
| Sonnet 5 | $0.00013 | $0.00239 |
| Haiku 4.5 | $0.00006 | $0.00119 |
Grade A, and why
app-store-toolkit:audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/app-store-toolkit:audit
You are auditing an App Store submission. The result is a punch list: BLOCKERS first (will prevent submission), then QUALITY issues (won't block but worth fixing).
1. Load configured locales
Call store_read_config for the locale list. If $ARGUMENTS includes a specific locale, restrict to it.
2. Run the seven phases
For each locale in scope, run these phases and collect findings.
Phase 1: Locale parity (BLOCKER)
Call store_validate { locale }. Any missing required field becomes a finding: {check:"locale-parity", severity:"blocker", locale, field, message:"missing", fix:"run /aso for <locale>"}.
Phase 2: Char limits (BLOCKER)
The same store_validate call also reports char-limit violations. Each becomes: {check:"char-limit", severity:"blocker", locale, field, message:"<N> chars exceeds limit <L>", fix:"shorten <field>"}.
Phase 3: Required-field presence (BLOCKER)
- Call
store_read_listing. Flag ifcategories.primaryis empty. - Call
store_read_privacy. Flag ifcollectsDatais unset. - Call
store_read_review. Flag ifcontact.emailornotesis empty.
Phase 4: Asset dimensions (BLOCKER)
Call assets_validate_dimensions { locale }. Each ok:false result becomes a finding.
Phase 5: Voice drift (QUALITY)
For each locale, read the voice config from store_read_config and the description/promo/what's-new for that locale. Ask yourself (as the model): "Given the voice block <voice>, does this copy match? Return {drift: bool, rationale: string}." If drift: true, append {check:"voice-drift", severity:"quality", locale, rationale, fix:"rephrase to match voice"}.
Phase 6: App Review phrase risk (BLOCKER or QUALITY per rule)
Match the seed patterns against each locale's copy:
\b(diagnose|diagnosis)\b→ blocker\bguarantee(s|d)?\b→ quality\b(doctor[- ]ready|FDA[- ]approved)\b→ blocker
For each hit, do a context pass: is the hit inside a clearly-quoted user testimonial? If so, downgrade to severity:"quality". Otherwise use the rule's declared severity.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 104 lines · 64 tokens per session scan A 1004bd31351d
app-store-toolkit:audit is a skill published in the GitHub repository vishalvshekkar/app-store-toolkit (5 stars, last pushed 3mo ago), licensed MIT. It adds 64 tokens to every session and 1,194 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
flutter-setup-localization
Add flutterlocalizations and intl dependencies, enable "generate true" in pubspec.yaml, and create an l10n.yaml configuration file. Use when initializing localization support for a new Flutter project.
asc-localize-metadata
Automatically translate and sync App Store metadata (description, keywords, what's new, subtitle) to multiple languages using LLM translation and asc CLI. Use when asked to localize an app's App Store listing, translate app descriptions, or add new languages to App Store Connect.
asc-metadata-sync
Sync, validate, and apply App Store metadata with the current asc canonical metadata workflow. Use when updating metadata, localizations, keywords, or migrating legacy fastlane metadata.
ios-marketing-capture
Use when the user wants to automate capture of marketing screenshots for a SwiftUI iOS app across multiple locales, devices, or appearances. Covers full-screen shots, isolated element renders (carousel cards, widgets), and reproducible output naming. Triggers on marketing screenshots, locale screenshots, widget…
localization-l10n
Implement localization (l10n) best practices to adapt applications for specific regions, languages, and cultural preferences.
maui-localization-theming
Implement MAUI localization and theming. USE FOR: RESX/AppResources, runtime culture switching, RTL/FlowDirection, platform language metadata, AppThemeBinding, DynamicResource, light/dark/system themes, UserAppTheme. DO NOT USE FOR: general layout, accessibility audits, icon/splash assets.