NSAllowsArbitraryLoads gets questions from App Review, a secret in Info.plist is readable by anyone who unzips the .ipa, and a vague camera permission text gets the build rejected. This skill finds those and six other Apple app config problems before you submit, and tells you how to fix each one.

Your agent runs a scanner on your Xcode project: .plist files (XML and binary, read with Python's own plist reader), .xcconfig build settings and .entitlements files, and it notices .p8 and .p12 key files. It follows ATS settings into each exception domain, treats localhost and .local exceptions as development-only, knows that GoogleService-Info.plist keys, client IDs, Facebook client tokens and Mapbox public tokens are meant to be in the app, and reads .gitignore so ignored files are not reported. It never runs Xcode. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• I01: NSAllowsArbitraryLoads set to true (App Transport Security off)

• I02: an API secret, client secret, token or password in a plist or committed .xcconfig

• I03: an AuthKey .p8 or a .p12 file in the project that git does not ignore

REVIEW (check before release)

• I11: plain HTTP allowed for a real domain

• I12: arbitrary loads allowed in web views or media

• I13: TLS 1.0 or 1.1, or no forward secrecy, for an exception domain

• I14: empty, very short or placeholder permission texts (NS...UsageDescription)

• I15: get-task-allow in an entitlements file

• I16: UIFileSharingEnabled on

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example app config, and the real report the scanner produces on the risky one

Limits

It reads files as written: settings added at build time, Swift code, the signed app bundle and App Store Connect settings are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.