A Claude Code skill that audits an existing iOS/iPadOS codebase for App Store rejection risks before you submit, and writes a single report ranked by severity.
Apple rejected 24.85% of the 7.7M submissions it reviewed in 2024. Most of
those rejections are the same handful of causes, and a good share of them are
visible in the source tree: an undeclared required-reason API, a missing
Delete Account button, a hardcoded price on the paywall, a consent screen the
reviewer never sees.
| Area | Examples |
|---|---|
| Upload blockers (ITMS) | 91053/91055 required-reason APIs vs PrivacyInfo.xcprivacy, 91061 third-party SDK manifests, 90683 missing purpose strings, 90725 SDK minimum |
| Privacy (5.x) | Third-party AI consent (5.1.2(i)), ATT, account deletion (5.1.1(v)), purpose-string quality, health data isolation |
| Business (3.x) | IAP vs external payments, the seven required paywall elements, storefront-gated steering links |
| Design (4.x) | Webview wrappers (4.2), third-party SSO without Sign in with Apple (4.8), mini apps (4.7) |
| Performance (2.x) | Placeholder content, test keys, staging endpoints, hidden features, HealthKit transparency, references to other marketplaces |
| Submission artifacts | App icon and launch screen, export compliance, version keys, in-app Terms link — then it asks about the App Store Connect side it can't see: demo credentials, live privacy policy and support URLs, App Privacy labels, age rating |
Findings are ranked:
- HARD BLOCK — deterministic upload/review failure
- LIKELY REJECTION — matches a documented rejection cause
- RISK FLAG — needs a human: metadata, minimum functionality, spam risk
Every finding carries a guideline number, evidence as file:line, the fix, and
a source URL.
Copy the skill directory into your skills folder:
git clone https://github.com/artbyjazi/app-store-approval.git /tmp/asa
cp -r /tmp/asa/app-store-approval ~/.claude/skills/Per-project instead of per-user:
cp -r /tmp/asa/app-store-approval .claude/skills/Restart Claude Code (or start a new session) and the skill is available.
Open your iOS project in Claude Code and just say what you want:
Is my app ready for App Store submission?
I got rejected under Guideline 5.1.2(i) — here's the notice. Help me fix it.
Upload failed with ITMS-91053. What's missing?
The skill triggers on any of that without being named. To force it:
/app-store-approval
It writes APP_STORE_APPROVAL.md in the project root.
You can also run the static scans on their own, with no Claude involved:
bash ~/.claude/skills/app-store-approval/scripts/run_all.sh ~/dev/MyApp# App Store submission audit — MyApp
Audited 2026-08-01 · 2 HARD BLOCK · 4 LIKELY REJECTION · 3 RISK FLAG
## HARD BLOCK
### 1. ITMS-91053 — UserDefaults used with no privacy manifest entry
**Evidence:** `Sources/Storage.swift:6`, `Sources/Settings.swift:31`
**Why:** Apple rejects the upload when a required-reason API is used without a
declared reason. Nothing reaches review.
**Fix:** Add NSPrivacyAccessedAPICategoryUserDefaults with reason CA92.1 to
PrivacyInfo.xcprivacy.
**Source:** https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api
### 2. 5.1.1(v) — account creation with no in-app deletion path
**Evidence:** `Sources/AuthView.swift:19` (createAccount), no Delete Account action
**Why:** Reviewers test the button by hand. Sign-out is not deletion.
**Fix:** Add an in-app Delete Account action that calls a real server-side
deletion and revokes the Sign in with Apple credential.
## LIKELY REJECTION
…
## Manual review checklist
- [ ] Screenshots and description match the shipped build (2.3)
- [ ] Working demo account in App Review notes, tested on a cold install (2.1)
…
app-store-approval/ the skill — copy this into .claude/skills/
├── SKILL.md workflow, severity triage, report format
├── references/
│ ├── rejection-db.md guideline → rule → detection → fix
│ ├── privacy.md manifests, required-reason APIs, ATT, AI consent
│ ├── iap-storekit.md 3.1.x by region, the seven paywall elements
│ ├── metadata-review.md 2.1/2.3/4.3, review notes, appeals
│ ├── submission-artifacts.md the App Store Connect side: demo accounts,
│ │ URLs, EULA, labels, age rating, export compliance
│ └── deadlines.md dated requirements, with re-verify dates
└── scripts/ ten static scans + run_all.sh
tests/ three fixture projects + smoke tests
The references are loaded progressively — the skill reads deadlines.md first
and then only the files the scan results point at, so a small audit stays small.
Apple's guidelines are a living document; one update (Nov 13, 2025) changed
5.1.2(i), 4.1(c) and 4.7 at the same time. Everything here was verified in
August 2026, and references/deadlines.md carries explicit re-verify dates
so the skill can tell the user when its own facts have gone stale.
Sources of truth:
- https://developer.apple.com/app-store/review/guidelines/
- https://developer.apple.com/news/upcoming-requirements/
- https://developer.apple.com/support/third-party-SDK-requirements/
The rejection database is the community-maintainable part — if you were rejected for something not covered here, please add it. See CONTRIBUTING.md.
This is a risk-scoring tool, not a guarantee of approval. Reviewer decisions are inconsistent: identical builds pass and then fail, especially under 4.3. Apple changes the guidelines without notice, and the facts here have a verification date on them for that reason. This is not legal advice.
MIT — see LICENSE.