UserDefaults.standard in your Swift code with no NSPrivacyAccessedAPICategoryUserDefaults entry, or a reason code typed as c617.1 instead of C617.1, is enough for App Store Connect to refuse a build, and a full URL where Apple expects a bare tracking domain makes the manifest invalid. This skill finds those and the other privacy manifest mistakes before you upload, and tells you how to fix each one.

Your agent runs a scanner on your project: PrivacyInfo.xcprivacy files, the manifests Cordova (config.xml) and Expo (app.json, app.config.json) write at build time, Info.plist and other plists, Swift, Objective-C and C/C++ code, Xcode project files (classic groups and Xcode 16 synchronized folders), Package.swift, Podfile, Podfile.lock, Package.resolved and Flutter pubspec.lock. It checks every key and value against Apple's lists of categories, reason codes, data types and purposes, works out which manifest covers which code (app, extension, Swift package), and skips comments, strings, tests and vendored code (Pods, Cordova plugins and platforms). Manifests inside Pods are checked only for what makes App Store Connect reject them, and a manifest in a library's resource bundle covers that library's code. It never builds or runs the project. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach, and every rule links the Apple documentation behind it. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• P01: required reason APIs used in your code (UserDefaults, @AppStorage, file timestamps, stat, systemUptime, mach_absolute_time, disk space keys, statfs, activeInputModes) with no manifest that declares the category (iOS, iPadOS, tvOS, visionOS and watchOS projects)
• P02: manifests (files, Cordova config.xml or Expo config) that are not valid property lists or hold keys that are not privacy manifest keys
• P03: invalid NSPrivacyAccessedAPITypes entries (unknown or wrongly cased category, reason code not approved, wrongly cased or from another category, empty reason list, missing or extra key)
• P04: invalid tracking keys (wrong types, tracking true with an empty domain list, tracking false with domains, entries that are not a bare domain: a URL, a path, a query or a trailing slash)
• P05: invalid NSPrivacyCollectedDataTypes entries (unknown data type or purpose, missing or extra key, Linked or Tracking that is not a Boolean)

REVIEW (check before release)

• P11: tracking that does not add up (true with no domain list, domains without NSPrivacyTracking, a data type used for tracking while tracking is not declared, an App Tracking Transparency request with no manifest that says the app tracks)
• P12: privacy manifest keys in Info.plist or another plist, or a .xcprivacy file with the wrong name
• P13: SDKs from Apple's list locked to versions without a privacy manifest (Alamofire, Kingfisher, SDWebImage, SnapKit, Lottie, SwiftyJSON, Starscream, Firebase, RxSwift, SVProgressHUD, RealmSwift, Charts, Facebook SDK, AFNetworking, MBProgressHUD) and discontinued Flutter plugins (path_provider_ios, shared_preferences_ios, package_info, wakelock)
• P14: a PrivacyInfo.xcprivacy the app target does not copy, or a Swift package target that does not declare it as a resource
• P15: code that reads the advertising identifier, identifierForVendor, location, contacts or health data with no matching collected data type
• P16: a required reason API declared in another target's manifest but not in the one next to the code (app extensions, frameworks)
• P17: an app's own manifest that declares 0A2A.1 or C56D.1, reasons reserved for third-party SDKs
• P18: required reason API use in an Expo project whose manifest comes from app.config.js or app.config.ts that does not name the category (the config cannot be run, so this is a review item)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and Apple documentation link for each rule
• A risky and a safe example project (a notes app with a widget, a Swift package, CocoaPods and a small Expo app), and the real report the scanner produces on the risky one

Limits

It reads the project's files, not the built app: manifests inside binary SDKs, APIs called only by compiled SDKs, and code in Kotlin, C# or JavaScript are not checked. Build-time manifests are read from Cordova config.xml and Expo app.json or app.config.json; an Expo app.config.js or app.config.ts is only searched for category names, and manifests added by config plugins are not seen. Which manifest covers which code comes from folders, Swift packages and the Xcode project, not a full build graph. The SDK version table covers the SDKs named above; other SDKs on Apple's list are not reported. Whether a declared reason matches what the code really does, and whether data leaves the device, cannot be decided from the text. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 45 files: SKILL.md, the scanner in scripts/ (8 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (34 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.