app-store-review

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
12
Flagged
11
Chunks
24
Flagged Files (11)
.claude-plugin/plugin.jsonHIGH
78.3%

Malicious tool definition detected

"name": "safaiyeh" }, "homepage": "https://github.com/safaiyeh/app-store-review-skill", "repository": "https://github.com/safaiyeh/app-store-review-skill", "license": "MIT", "keywords": ["apple", "app-store", "review", "guidelines", "ios", "macos", "swift", "react-native", "expo"] }

.gitignoreHIGH
78.3%

Malicious tool definition detected

Tool: .gitignore Description: # Claude Code .claude/ # Dependencies node_modules/ # Build outputs dist/ build/ # OS files .DS_Store Thumbs.db

LICENSEHIGH
78.3%

Malicious tool definition detected

Tool: LICENSE Description: MIT License Copyright (c) 2026 safaiyeh Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

SKILL.mdHIGH
78.3%

Malicious tool definition detected

func createAccount() { } // But no deleteAccount() ``` **React Native / Expo:** ```typescript // 🟡 Missing ATT (use expo-tracking-transparency) import analytics from '@react-native-firebase/analytics'; analytics().logEvent('event'); // Without ATT prompt = REJECTION // 🟡 Account deletion via website only Linking.openURL('https://example.com/delete'); // Must be in-app!

metadata.jsonHIGH
78.3%

Malicious tool definition detected

Tool: metadata.json Description: { "version": "1.0.0", "organization": "safaiyeh", "date": "January 2026", "abstract": "Exhaustive guide for evaluating iOS, macOS, tvOS, watchOS, and visionOS app code against Apple's App Store Review Guidelines.

rules/1-safety.mdHIGH
78.3%

Malicious tool definition detected

**Code patterns to flag:** ```swift // Swift - FLAG: Review all hardcoded strings for discriminatory content let strings = ["message", "alert", "notification"] // Audit for offensive language // FLAG: User-facing text that targets groups // Search for terms related to: religion, race, gender, nationality, orientation ``` ```typescript // React Native - FLAG: Review all hardcoded strings const strings = { message: "...", // Audit for offensive language alert: "...", }; // FLAG: Check i18n/localiz

Tool: rules/1-safety.md [2/3] Description: const blockUser = async (userId: string): Promise<void> => { await api.post(`/users/${userId}/block`); }; const getBlockedUsers = async (): Promise<User[]> => { return api.get('/users/blocked'); }; // REQUIRED: Support contact - expose in app const SUPPORT_EMAIL = 'support@example.com'; const SUPPORT_URL = 'https://example.com/support'; ``` ### Content That Results in Removal Apps primarily used for the following will be removed WITHOUT notice: - Pornog

rules/2-performance.mdHIGH
78.3%

Tool passed security scan

Malicious tool definition detected

Tool: rules/2-performance.md [2/4] Description: ] Irrelevant phrases to game the system **App subtitles must:** - [ ] Follow standard metadata rules - [ ] Not include inappropriate content - [ ] Not reference other apps - [ ] Not make unverifiable product claims ### 2.3.8 Age-Appropriate Metadata - [ ] Metadata must be appropriate for ALL audiences - [ ] Icons, screenshots, previews must adhere to 4+ rating (even if app is rated higher) - [ ] Do NOT depict violence, weapons, or mature content in

NOT allowed in:** - [ ] Extensions - [ ] App Clips - [ ] Widgets - [ ] Notifications - [ ] Keyboards - [ ] watchOS apps **Ad requirements:** - [ ] Appropriate for app's age rating - [ ] Allow user to see all targeting information without leaving app - [ ] No targeted/behavioral advertising based on: - Health/medical data (HealthKit) - School/classroom data (ClassKit) - Kids data (Kids Category apps) **Interstitial/blocking ads must:** - [ ] Clearly indicate they are ads - [ ] Not manipulate/tric

rules/3-business.mdHIGH
78.3%

Malicious tool definition detected

Tool: rules/3-business.md [1/3] Description: --- name: business description: App Store Review Guidelines Section 3 - Business (in-app purchase, subscriptions, cryptocurrencies, other business models) --- # 3.

Listen for purchase updates const purchaseListener = IAP.purchaseUpdatedListener(async (purchase) => { if (purchase.transactionReceipt) { // Validate on server await validatePurchase(purchase); // Deliver content await deliverContent(purchase.productId); // CRITICAL: Finish transaction await IAP.finishTransaction({ purchase, isConsumable: false }); } }); init(); return () => { purchaseListener.remove(); IAP.endConnection(); }; }, []); // 3.

rules/4-design.mdHIGH
78.3%

Malicious tool definition detected

Tool: rules/4-design.md [1/3] Description: --- name: design description: App Store Review Guidelines Section 4 - Design (copycats, minimum functionality, spam, extensions, Apple services, login) --- # 4.

const { email, fullName } = credential; await authenticateWithBackend(credential); }; // Third-party login const signInWithGoogle = async () => { await GoogleSignin.hasPlayServices(); const userInfo = await GoogleSignin.signIn(); await authenticateWithBackend(userInfo); }; // Email-only alternative (collects only name + email) const signInWithEmail = async (email: string, name: string) => { await authenticateWithBackend({ email, name }); }; return ( <View> {/* If you have Google login, you MUST

rules/5-legal.mdHIGH
78.3%

Malicious tool definition detected

Tool: rules/5-legal.md [1/4] Description: --- name: legal description: App Store Review Guidelines Section 5 - Legal (privacy, data collection, intellectual property, gambling, VPN, MDM) --- # 5.

Tool: rules/5-legal.md [4/4] Description: [ ] Must have necessary licensing/permissions - [ ] Must be geo-restricted to licensed locations - [ ] Must be free on App Store - [ ] No illegal gambling aids (card counters) - [ ] Lottery apps must have consideration, chance, and prize ```swift // REQUIRED: Geo-restriction for gambling apps func checkGamblingEligibility() -> Bool { guard let region = Locale.current.region?.identifier else { return false } let licensedRegions = ["US-NJ", "US-NV", "GB"]

README.mdHIGH
74.2%

Malicious tool definition detected

**Supports:** Swift, Objective-C, **React Native**, and **Expo** apps ## Installation ### Claude Code Plugin Marketplace ```bash /plugin marketplace add safaiyeh/app-store-review-skill /plugin install app-store-review@app-store-review ``` ### skills.sh ```bash npx skills add safaiyeh/app-store-review-skill ``` ## Setup ### Supported AI Agents This skill works with any AI coding agent that supports the skills.sh standard: - [Claude Code](https://claude.ai/code) - [Cursor](https://cursor.sh) - [Wi

Passed Files (1)Click to expand
.claude-plugin/marketplace.jsonOK
13.2%

Tool passed security scan

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
12
Files Flagged
11
Chunks Analyzed
24
Analyzed
Feb 21, 2026, 11:10 AM
Security Audit — runlayer — app-store-review