app-store-preflight-skills

---
name: app-store-preflight-skills
description: >
  Scan an iOS/macOS Xcode project for common App Store rejection patterns before
  submission. Use when preparing an app for App Store review, after receiving a
  rejection from Apple, or when auditing metadata, subscriptions, privacy manifests,
  entitlements, or design compliance. Integrates with the asc CLI for metadata inspection.
metadata:
  author: truongduy2611
  version: "1.0"
---

# App Store Preflight Skill

Run pre-submission checks on your iOS/macOS project to catch common App Store rejection patterns.

## Prerequisites

- **asc CLI** — Install via Homebrew: `brew install asc` ([App-Store-Connect-CLI](https://github.com/rudrankriyam/App-Store-Connect-CLI))
- **ASC CLI Skills** — [app-store-connect-cli-skills](https://github.com/rudrankriyam/app-store-connect-cli-skills) for `asc` usage patterns
- **jq** — Optional, but used by some JSON-inspection examples in the rule docs

## Step 1: Identify App Type → Load Checklist

Determine which guidelines apply by loading the relevant checklist from `references/guidelines/by-app-type/`. Always start with `all_apps.md`, then add the app-type-specific one:

| App Type | Checklist |
|----------|-----------|
| Every app | `references/guidelines/by-app-type/all_apps.md` |
| Subscriptions / IAP | `references/guidelines/by-app-type/subscription_iap.md` |
| Social / UGC | `references/guidelines/by-app-type/social_ugc.md` |
| Kids Category | `references/guidelines/by-app-type/kids.md` |
| Health & Fitness | `references/guidelines/by-app-type/health_fitness.md` |
| Games | `references/guidelines/by-app-type/games.md` |
| macOS | `references/guidelines/by-app-type/macos.md` |
| AI / Generative AI | `references/guidelines/by-app-type/ai_apps.md` |
| Crypto & Finance | `references/guidelines/by-app-type/crypto_finance.md` |
| VPN | `references/guidelines/by-app-type/vpn.md` |

Full guideline index: `references/guidelines/README.md`

## Step 2: Pull Metadata for Inspection

Pull the latest App Store metadata using the `asc` CLI:

```bash
# Pull canonical metadata JSON for the version you want to review
asc metadata pull --app "<APP_ID>" --version "<VERSION>" --dir ./metadata
```

`asc metadata pull` writes app info files to `./metadata/app-info/*.json` and
version-localization files to `./metadata/version/<VERSION>/*.json`.

Most rule examples below assume the canonical JSON layout written by
`asc metadata pull`.

If you already have metadata in another layout (for example fastlane
`metadata/`), either adapt the file-path examples to that structure or pull the
canonical `asc` layout first.

## Step 3: Run Rejection Rule Checks

For each category, load the relevant rule files from `references/rules/` and inspect. Each rule contains: **What to Check**, **How to Detect**, **Resolution**, and **Example Rejection**.

| Category | Rule Files |
|----------|------------|
| Metadata | `references/rules/metadata/*.md` |
| Subscription | `references/rules/subscription/*.md` |
| Privacy | `references/rules/privacy/*.md` |
| Design | `references/rules/design/*.md` |
| Entitlements | `references/rules/entitlements/*.md` |

## Step 4: Report Findings

Produce a summary report using this template:

```markdown
## Preflight Report

### ❌ Rejections Found (N)
- [GUIDELINE X.X.X] Description of issue
  - File: path/to/offending/file
  - Fix: What to do

### ⚠️ Warnings (N)
- [GUIDELINE X.X.X] Potential issue

### ✅ Passed (N)
- [Category] All checks passed
```

Order by severity: rejections first, then warnings, then passed.

## Step 5: Autofix + Validate

Some issues can be auto-fixed:
- **Competitor terms** → Suggest replacement text with competitor names removed
- **Metadata character limits** → Show current vs. max length
- **Missing links** → Generate template ToS/PP URLs

After applying any auto-fix, **re-run the affected checks** to confirm the fix resolved the violation. Only mark as resolved once the re-scan passes.

For issues requiring manual intervention (screenshots, UI redesign), provide clear instructions but do not auto-fix.

## Gotchas

- **China storefront** — Banned AI terms (ChatGPT, Gemini, etc.) are checked across ALL locales, not just `zh-Hans`. Apple checks every locale visible in the China storefront.
- **Privacy manifests** — `PrivacyInfo.xcprivacy` is required even if your app doesn't call Required Reason APIs directly. Third-party SDKs (Firebase, Amplitude, etc.) that use `UserDefaults` or `NSFileManager` trigger this requirement transitively.
- **asc auth** — `asc metadata pull` requires App Store Connect authentication. Run `asc auth login` first, or set `ASC_KEY_ID`, `ASC_ISSUER_ID`, and one of `ASC_PRIVATE_KEY_PATH` / `ASC_PRIVATE_KEY` / `ASC_PRIVATE_KEY_B64`. If you're unsure what `asc` is picking up, run `asc auth doctor`.
- **Subscription metadata** — Apple requires ToS/PP links in BOTH the App Store description AND the in-app subscription purchase screen. Missing either one is a separate rejection.
- **macOS entitlements** — Apple will ask you to justify every temporary exception entitlement (`com.apple.security.temporary-exception.*`). Remove entitlements you don't actively use.

## Adding New Rules

Create a `.md` file in the appropriate `references/rules/` subdirectory:

```markdown
# Rule: [Short Title]
- **Guideline**: [Apple Guideline Number]
- **Severity**: REJECTION | WARNING
- **Category**: metadata | subscription | privacy | design | entitlements

## What to Check
## How to Detect
## Resolution
## Example Rejection
```

From truongduy2611/app-store-preflight-skills at e52e007, shown as plain text under its license: MIT (permissive). The license text is in LICENSE.

• SKILL.md5.6 KB · 7585a88dd378
• LICENSE1.1 KB · 5650e1ecba2c
• README.md5.8 KB · ce8c22662497
• references/
• guidelines/
• README.md9.9 KB · 2ea2523b2055
• by-app-type/
• ai_apps.md2.0 KB · b4dd64139320
• all_apps.md2.9 KB · 82d6bfbdb784
• crypto_finance.md1.9 KB · 4cd3d0fe1931
• games.md1.9 KB · c36cd9981030
• health_fitness.md1.9 KB · 6c794eda1697
• kids.md1.5 KB · 927516a3ea25
• macos.md2.3 KB · 0ad225707de5
• social_ugc.md1.9 KB · 7ab99ebc2f80
• subscription_iap.md2.0 KB · 03a8744325d4
• vpn.md818 B · a4b051f6f510
• rules/
• design/
• minimum_functionality.md4.0 KB · e07e7c2d3f63
• sign_in_with_apple.md2.9 KB · bc3e4002af8e
• entitlements/
• unused_entitlements.md3.4 KB · 652f832bbdb1
• metadata/
• accurate_metadata.md2.6 KB · 09b591d508f7
• apple_trademark.md4.1 KB · 442a558e1eb3
• china_storefront.md3.5 KB · bc9a8531f639
• competitor_terms.md2.0 KB · 993326fd0054
• review_notes_new_submission.md4.8 KB · dbe523b3e5f6
• review_notes_template.md2.4 KB · 7dedfb2527fc
• subscription_metadata.md3.1 KB · f9dfc3695acd
• privacy/
• privacy_manifest.md3.4 KB · ae392e1901c4
• unnecessary_data.md2.6 KB · 170b42ab144d
• subscription/
• misleading_pricing.md3.1 KB · b1ca5abb170b
• missing_tos_pp.md2.4 KB · f5b6a9428777

28 files, 86 KB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.