Imported from berkayturk/appstore-precheck (AGENTS.md). Install upstream with npx skills add berkayturk/appstore-precheck. Copyright stays with the author.

AGENTS.md

Cross-tool instructions for any coding agent working in or consuming this repository. This file follows the agents.md convention and is read by Codex, Cursor, Gemini CLI, Grok Build, GitHub Copilot, and others as always-on context.

What this repo is

appstore-precheck is a single Agent Skill (open standard: agentskills.io) that runs a read-only, pre-submission check for an iOS app before App Store review. The skill lives at skills/appstore-precheck/; its scanner, scripts/scan.sh, is portable Bash and can be run by any agent or by hand. Phase 4 runs 28 Pierre deep-review checks (22 Tier A + 6 Tier B v1 heuristic; see references/pierre-deep-review.md).

Using the skill in your project

The same SKILL.md is consumed natively by Claude Code, Claude API/apps, OpenAI Codex, Cursor, Gemini CLI, and Grok Build, with no per-tool conversion. They differ only in which directory they scan:

Install: Claude Code, Cursor, Codex, and Grok Build as native plugins from this repo (see README Quick start). Gemini: gemini skills install https://github.com/berkayturk/appstore-precheck.git --path skills/appstore-precheck. Fallback: ./install.sh copies the skill into .claude/skills/, .agents/skills/, and/or .grok/skills/ of the current project, or ./install.sh <host> <project|user> for a single host.

The hard rule

Before any App Store submission, run the precheck and do not upload without a GREEN result.

bash skills/appstore-precheck/scripts/scan.sh   # or .agents/skills/appstore-precheck/scripts/scan.sh once installed

Then follow references/methodology.md. A FAIL means submission is blocked; 5+ WARN means get explicit human confirmation first. Phase 4 REVIEW-FINDING lines are advisory — they do not block the token.

Contributing to this repo

• scripts/scan.sh is the engine; keep it portable POSIX-ish Bash, forward-slash paths only.
• Keep SKILL.md under 500 lines; push detail into references/.
• After changing the scanner or manifests, run npm test (or bash tests/run.sh), claude plugin validate ., and grok plugin validate ..
• Do not commit secrets. The App Store Connect API key is provided at runtime via env and deleted immediately after use; .gitignore blocks *asc-key*.json and .env.