Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Xopoko/build-swift-apps --skill appstore-record-creatorgit clone --depth 1 https://github.com/Xopoko/build-swift-appsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xopoko/build-swift-apps/appstore-record-creator)<a href="https://agentmods.dev/skills/xopoko/build-swift-apps/appstore-record-creator"><img src="https://agentmods.dev/badge/skills/xopoko/build-swift-apps/appstore-record-creator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xopoko/build-swift-apps/appstore-record-creator"><img src="https://agentmods.dev/badge/skills/xopoko/build-swift-apps/appstore-record-creator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00611 |
| Opus 5 | $0.00018 | $0.00305 |
| Sonnet 5 | $0.00007 | $0.00122 |
| Haiku 4.5 | $0.00004 | $0.00061 |
Grade A, and why
appstore-record-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App Store Record Creator
Opt-in local browser automation for App Store Connect app creation. The user must be signed in; the bundle ID must already exist.
Preconditions
- Playwright, Cursor browser MCP, or equivalent visible browser automation.
- User can complete login and 2FA.
- Inputs: app name (<=30 chars), registered unused bundle ID, SKU, platform(s), primary language, user access.
Guardrails
- Never export/store cookies.
- Use a visible session only.
- Pause before final Create click in standalone scripts.
- Do not retry Create automatically.
Workflow
- Preflight:
asc bundle-ids create --identifier "com.example.app" --name "My App" --platform IOS asc apps list --bundle-id "com.example.app" --output json - Open
https://appstoreconnect.apple.com/appsand confirm login. - Click the blue
+New App button, then theNew Appmenu item. It is a dropdown first, not a direct dialog. - Fill fields:
- Platform checkboxes: iOS, macOS, tvOS, visionOS; multiple allowed.
Name, max 30 chars.Primary Languagecombobox/select.Bundle IDselect: wait until async loading finishes after platform selection; choose label likeMy App - com.example.app.SKU.User Access: required radio,Limited AccessorFull Access.
- User Access radios may have span overlays; scroll the radio input into view and click the radio ref directly if accessibility click is intercepted.
- If Ember validation does not notice filled fields, clear/retype one text value slowly.
- Confirm, click Create, wait for
/apps/<APP_ID>/.... - Verify:
asc apps view --id "APP_ID" --output json --pretty asc apps list --bundle-id "com.example.app" --output json - Hand off:
Use the web availability flow only for first bootstrap; later useasc app-setup info set --app "APP_ID" --primary-locale "en-US" asc app-setup categories set --app "APP_ID" --primary GAMES asc web apps availability create --app "APP_ID" --territory "USA,GBR" --available-in-new-territories trueasc pricing availability edit.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 58 lines · 36 tokens per session scan A db994f2f1681
appstore-record-creator is a skill published in the GitHub repository Xopoko/build-swift-apps (45 stars, last pushed 13d ago), licensed MIT. It adds 36 tokens to every session and 611 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
preview-screens
Use when the user wants to preview generated screens in a browser without starting Metro / a simulator — for example after /create-mobile-app finishes or after /edit-app regenerates a screen.
playwright-recording
Record browser interactions as video using Playwright. Use for capturing demo videos, app walkthroughs, and UI flows for Remotion videos. Triggers include recording a demo, capturing browser video, screen recording a website, or creating walkthrough footage.
firebase-messaging
Use when setting up Firebase Cloud Messaging, managing permissions and tokens, handling background/foreground notification taps, or dispatching messages server-side (HTTP v1).
dev-browser
Browser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website"…
firebase-ai
Use when setting up firebaseai, generating text/chat with Gemini, streaming AI output, building multimodal prompts, or handling AI errors.
tavily-usage
This skill should be used when user asks to "search the web", "fetch content from URL", "extract page content", "use Tavily search", "scrape this website", "get information from this link", or "web search for X".