appstore-review-skill

appstore-review-skill

A Claude Code plugin that audits your iOS app against Apple's App Store Review Guidelines — before Apple rejects it.

Stop guessing. Run /appstore-review and get a full compliance report in seconds.

Supported Frameworks

This skill auto-detects your project type and adapts all checks accordingly:

Installation

Via Plugin Manager (Recommended)

/plugin marketplace add devsemih/appstore-review-skill
/plugin install appstore-review-skill

Via Git Clone

Global (all projects):

git clone https://github.com/devsemih/appstore-review-skill ~/.claude/skills/appstore-review-skill

Project-specific:

git clone https://github.com/devsemih/appstore-review-skill .claude/skills/appstore-review-skill

Then restart Claude Code.

Updating

Plugin Manager

/plugin marketplace update

Git Clone

cd ~/.claude/skills/appstore-review-skill && git pull

Usage

Open your project in Claude Code and run:

/appstore-review

That's it. The skill will scan your project and output a structured compliance report.

What Gets Checked

Section 1 — Safety

• Objectionable content in strings and resources
• User-generated content moderation (filtering, reporting, blocking)
• Kids Category compliance (no third-party analytics/ads)
• Medical app disclaimers and physical harm checks
• Developer contact / support URL accessibility
• Data security (ATS, hardcoded secrets, secure storage)
• Criminal activity reporting app restrictions

Section 2 — Performance

• App completeness (TODOs, placeholders, debug code, staging URLs)
• Beta / trial / demo labels in production app (must use TestFlight)
• Info.plist / app.json required keys and usage descriptions
• iPad support and adaptive layout
• Private API usage, IPv6 compatibility
• All NS*UsageDescription keys cross-checked against actual SDK usage

Section 3 — Business

• In-App Purchase compliance (digital goods must use IAP)
• Restore Purchases mechanism and subscription terms display
• Detection of Stripe/PayPal for digital content (violation)
• Loot box odds disclosure
• Review prompt abuse

Section 4 — Design

• Minimum functionality (web wrapper detection)
• Sign in with Apple — required when any third-party login exists
• Bundle ID uniqueness
• Extension compliance (keyboard, Safari, widgets, App Clips)
• Apple Sites and Services (Push Notification abuse, Apple Music rules)
• Apple Pay branding and recurring payment disclosures
• No monetization of built-in OS/hardware capabilities

Section 5 — Privacy & Legal

• PrivacyInfo.xcprivacy existence and completeness
• Required API reason declarations
• Account deletion — required when account creation exists
• App Tracking Transparency for ad/analytics SDKs
• Health data protection (no ads/marketing use of HealthKit data)
• Kids privacy (COPPA, GDPR children's provisions)
• Location services justification
• Hardcoded credentials and .env file exposure
• Intellectual property and third-party content usage
• Gaming, gambling, and lottery compliance
• VPN app requirements (NEVPNManager API)
• Mobile Device Management (MDM) restrictions
• Developer Code of Conduct (dark patterns, scam detection)

Quick-Check — Top 10 Rejection Reasons

1. Crashes / risky code patterns
2. Broken or HTTP links
3. Incomplete metadata
4. Missing privacy descriptions
5. No privacy policy URL
6. Debug / test code left in production
7. Hardcoded API keys and secrets
8. Missing Sign in with Apple
9. Missing account deletion
10. Missing privacy manifest

Example Reports

# App Store Review Compliance Report

## Project Summary
- App Name: MyApp
- Bundle ID: com.example.myapp
- Framework: Swift / SwiftUI
- Deployment Target: iOS 16.0

## Critical Issues

### [CRITICAL] Guideline 4.8 — Sign in with Apple Required
Issue: App uses Google Sign-In but does not implement Sign in with Apple
Location: AuthManager.swift:45
Fix: Add ASAuthorizationAppleIDProvider flow alongside Google Sign-In

### [CRITICAL] Guideline 5.1.1(v) — Account Deletion Missing
Issue: App has account creation but no account deletion feature
Location: SettingsView.swift
Fix: Add "Delete Account" option in settings with server-side deletion

## Final Verdict: NEEDS FIXES — 2 critical issues must be resolved