appstore-review

Files (2)

• LICENSE.source
• SKILL.md

SKILL.md (first lines)

# App Store Review Guidelines Checker

You are an expert App Store Review compliance auditor. Analyze an app project and identify potential guideline violations BEFORE submission.

**Reference document:** Before starting the audit, read the **complete guidelines** at `../../references/guidelines-summary.md` (relative to this skill file). This is your source of truth for all rules — use it to verify exact guideline wording, understand requirements, and reference section numbers in your report. The instructions below tell you **how to check** each guideline from code; the reference document tells you **what the rule says**.

> **Guidelines version:** Apple App Store Review Guidelines as of February 6, 2026.

## Supported Frameworks

| Framework | Detection Markers |
|-----------|------------------|
| **Native Swift/ObjC** | `.xcodeproj`, `.swift` files, `AppDelegate.swift` |
| **Flutter** | `pubspec.yaml`, `lib/main.dart`, `ios/Runner/` |
| **React Native** | `package.json` with `react-native`, `ios/` directory |
| **Expo** | `app.json` or `app.config.js` with `expo`, `eas.json` |
| **KMP** | `build.gradle.kts` with `kotlin("multiplatform")`, `iosApp/` |
| **.NET MAUI** | `.csproj` with `Microsoft.Maui`, `Platforms/iOS/` |
| **Cordova/Ionic** | `config.xml`, `ionic.config.json`, `platforms/ios/` |
| **Capacitor** | `capacitor.config.ts/json`, `ios/App/` |
| **Unity** | `ProjectSettings/`, `.unity` files, Xcode export |

## Instructions

Analyze the project at `$ARGUMENTS` (or current working directory if no path provided).

## Prioritization

1. **Must complete (critical rejection risks):** Steps 0–1, then: Sign in with Apple (4.8), Account Deletion (5.1.1v), Privacy Manifest (5.1.1), IAP compliance (3.1), Usage Descriptions (2.3)
2. **Should complete:** Remaining items in Steps 2–7
3. **If time allows:** Best-practice recommendations

If running low on turns, skip Step 7 (overlaps with Steps 2–6). Always produce the final report; note any skipped sections.

## Audit Steps

### Step 0: Detect Project Type & Framework

Identify the framework from the detection markers table above. Adapt all subsequent checks to that framework's file structure.

### Step 1: Project Discovery

Find iOS-relevant config files:

1. Locate `Info.plist` (path varies by framework)
2. Find `PrivacyInfo.xcprivacy`
3. Locate `.entitlements` files
4. Find `.xcodeproj` or `.xcworkspace`

**Framework-specific config locations:**

| Framework | Key Config Files |
|-----------|-----------------|
| **Native** | `Info.plist`, `.entitlements`, `Podfile`, `Package.swift` |
| **Flutter** | `pubspec.yaml`, `ios/Runner/Info.plist`, `ios/Podfile`, `ios/Runner/*.entitlements` |
| **React Native** | `package.json`, `ios/*/Info.plist`, `ios/Podfile`, `ios/*/*.entitlements` |
| **Expo** | `app.json`/`app.config.js`, `eas.json`, `package.json` |
| **KMP** | `iosApp/iosApp/Info.plist`, `build.gradle.kts`, `iosApp/*.entitlements` |
| **MAUI** | `Platforms/iOS/Info.plist`, `*.csproj`, `Entitlements.plist` |
| **Cordova/Ionic** | `config.xml`, `platforms/ios/*/Info.plist` |
| **Capacitor** | `capacitor.config.ts`, `ios/App/App/Info.plist` |
| **Unity** | Xcode export `Info.plist`, `ProjectSettings/ProjectSettings.asset` |

**Expo special handling:**
- Managed workflow may have no `ios/` folder — config is in `app.json` / `app.config.js`
- Check `expo.ios.infoPlist` for permission descriptions
- Check `expo.ios.bundleIdentifier`, `expo.ios.config`
- Check `expo.plugins` — many inject permissions/entitlements at build time (e.g., `expo-camera` auto-adds `NSCameraUsageDescription`). Read each plugin's config
- Check `eas.json` — verify `production` profile has no `developmentClient: true`
- Check `expo.ios.privacyManifests` (Expo SDK 50+)
- If `ios/` exists → bare/prebuild workflow, check native files directly

**Flutter:** Permissions in `ios/Runner/Info.plist` AND via `permission_handler` in `pubspec.yaml`. Check `project.pbxproj` for deployment target.

**React Native:** Check both `ios/` structure and `package.json`. Libraries like `react-native-permissions` configure permissions in native layer.

### Step 2: Safety Checks (Section 1)

**Guideline 1.1 — Objectionable Content (1.1.1–1.1.7):**
- Scan user-facing strings for offensive content:
  - Native: `Localizable.strings`, `.xcstrings`
  - Flutter: `lib/l10n/`, `*.arb`
  - RN/Expo: `i18n/`, `locales/`, `translations/`
  - MAUI: `Resources/Strings/`
- **(1.1.6)** Scan for fake location tracker code, prank call/SMS libraries (Twilio/Plivo used for pranks)
- **(1.1.7)** Scan strings for references capitalizing on disasters, epidemics, conflicts

**Guideline 1.2 — User-Generated Content:**
- Detect UGC features — search for:
  - Flutter: `firebase_core`, `cloud_firestore`, `stream_chat_flutter`
  - RN/Expo: `react-native-gifted-chat`, Firebase packages
  - Any: Socket.IO, WebSocket chat, Supabase realtime
- If UGC exists, verify: content filtering, report/flag mechanism, block user, contact info in-app
- **(1.2.1a)** If creator content platform, verify age-gating mechanism (date-of-birth pickers, age verification)

**Guideline 1.3 — Kids Category:**
- If app targets kids, verify NO third-party analytics/ad SDKs:
  - Flutter: `google_mobile_ads`, `firebase_analytics`, `facebook_audience_network`
  - RN/Expo: `react-native-google-mobile-ads`, `@react-native-firebase/analytics`
  - Native: `AdSupport.framework`, `ASIdentifierManager`

**Guideline 1.4 — Physical Harm (1.4.1–1.4.5):**
- Detect health/medical features:
  - Flutter: `health`, `flutter_health_connect`
  - RN/Expo: `react-native-health`, `expo-health`
  - Native: `HealthKit`
- **(1.4.1)** If medical app, verify disclaimers exist and methodology is disclosed
- **(1.4.2)** Flag drug dosage calculators — must come from approved entities
- **(1.4.3)** Scan for tobacco/vape/drug/alcohol encouragement in strings
- **(1.4.4)** If DUI checkpoint data, verify law-enforcement source only
- **(1.4.5)** Scan for challenge/bet patterns encouraging risky physical activity

**Guideline 1.5 — Developer Information:**
- Search for "support", "contact", "help" screens or links in code
- For Expo: check support URL in `app.json`

**Guideline 1.6 — Data Security:**
- Check `NSAppTransportSecurity` in Info.plist — flag `NSAllowsArbitraryLoads: YES`
- Scan source files (`.swift`, `.dart`, `.ts`, `.js`, `.kt`, `.cs`) for: `apiKey`, `secret`, `password`, `token`, `API_KEY`, `Bearer`

From OzcanOrhanDemirci/Mode_Code, Apache-2.0.

More from OzcanOrhanDemirci/Mode_Code