appstore-review-skill

A Claude Code plugin that audits your mobile app against store review policies — before the store rejects it.

Two skills, one plugin:

Stop guessing. Run the command and get a full compliance report in seconds.

---

Supported Frameworks

Both skills auto-detect your project type and adapt all checks accordingly:

Installation

Via Plugin Manager (Recommended)

/plugin marketplace add devsemih/appstore-review-skill
/plugin install appstore-review-skill

Via Git Clone

Global (all projects):

git clone https://github.com/devsemih/appstore-review-skill ~/.claude/skills/appstore-review-skill

Project-specific:

git clone https://github.com/devsemih/appstore-review-skill .claude/skills/appstore-review-skill

Then restart Claude Code.

Updating

Plugin Manager

/plugin marketplace update

Git Clone

cd ~/.claude/skills/appstore-review-skill && git pull

Usage

Open your project in Claude Code and run:

/appstore-review     # audit against Apple's App Store guidelines
/playstore-review    # audit against Google Play policies

That’s it. The skill will scan your project and output a structured compliance report.

---

/appstore-review — What Gets Checked

Section 1 — Safety

• Objectionable content in strings and resources
• User-generated content moderation (filtering, reporting, blocking)
• Kids Category compliance (no third-party analytics/ads)
• Medical app disclaimers and physical harm checks
• Developer contact / support URL accessibility
• Data security (ATS, hardcoded secrets, secure storage)
• Criminal activity reporting app restrictions

Section 2 — Performance

• App completeness (TODOs, placeholders, debug code, staging URLs)
• Beta / trial / demo labels in production app (must use TestFlight)
• Info.plist / app.json required keys and usage descriptions
• iPad support and adaptive layout
• Private API usage, IPv6 compatibility
• All NS*UsageDescription keys cross-checked against actual SDK usage

Section 3 — Business

• In-App Purchase compliance (digital goods must use IAP)
• Restore Purchases mechanism and subscription terms display
• Detection of Stripe/PayPal for digital content (violation)
• Loot box odds disclosure
• Review prompt abuse

Section 4 — Design

• Minimum functionality (web wrapper detection)
• Sign in with Apple — required when any third-party login exists
• Bundle ID uniqueness
• Extension compliance (keyboard, Safari, widgets, App Clips)
• Apple Sites and Services (Push Notification abuse, Apple Music rules)
• Apple Pay branding and recurring payment disclosures
• No monetization of built-in OS/hardware capabilities

Section 5 — Privacy & Legal

• PrivacyInfo.xcprivacy existence and completeness
• Required API reason declarations
• Account deletion — required when account creation exists
• App Tracking Transparency for ad/analytics SDKs
• Health data protection (no ads/marketing use of HealthKit data)
• Kids privacy (COPPA, GDPR children’s provisions)
• Location services justification
• Hardcoded credentials and .env file exposure
• Intellectual property and third-party content usage
• Gaming, gambling, and lottery compliance
• VPN app requirements (NEVPNManager API)
• Mobile Device Management (MDM) restrictions
• Developer Code of Conduct (dark patterns, scam detection)

Quick-Check — Top 10 App Store Rejection Reasons

1. Crashes / risky code patterns
2. Broken or HTTP links
3. Incomplete metadata
4. Missing privacy descriptions
5. No privacy policy URL
6. Debug / test code left in production
7. Hardcoded API keys and secrets
8. Missing Sign in with Apple
9. Missing account deletion
10. Missing privacy manifest

---

/playstore-review — What Gets Checked

Privacy & User Data

• Privacy policy linked in-app (required in listing AND in app)
• Data safety consistency — every data-collecting SDK cross-checked against what must be declared in the Data safety form
• Prominent disclosure & consent before sensitive data collection
• Account deletion — in-app deletion + web resource required when account creation exists
• Advertising ID (AD_ID) usage and Android 13+ requirements

Permissions & Sensitive APIs

• SMS & Call Log restrictions (with SMS Retriever API alternatives)
• QUERY_ALL_PACKAGES, MANAGE_EXTERNAL_STORAGE — declaration-gated permissions
• Accessibility API misuse detection
• Background location — justification, declaration, prominent disclosure
• Photo/Video permissions vs. Android photo picker
• Foreground service types (Android 14+), exact alarms, full-screen intent
• VPN service, overlay, and package-install permission checks
• Unused-permission detection (minimal permission principle)

Monetization & Ads

• Google Play Billing compliance (digital goods must use Play Billing)
• Detection of Stripe/PayPal for digital content (violation)
• Subscription terms, trial disclosure, easy cancellation
• Disruptive ads (unexpected interstitials, lockscreen ads, hidden ads)
• Consent (UMP/CMP) before ad personalization
• Loot box odds disclosure, review prompt manipulation

Restricted Content

• Financial services (loan app rules: APR caps, repayment periods, prohibited permissions)
• Real-money gambling licensing and geo-restrictions
• User-generated content moderation (report, block, filter)
• Health Connect restricted data use
• Blockchain/NFT declarations
• AI-generated content reporting mechanism requirement

Device Abuse & Deception

• Dynamic code loading from outside Play (dex/native code)
• Hidden features and kill switches (post-review unlocks)
• Ad fraud patterns, overlay abuse
• Fake system dialogs, cleaner/booster scams
• Malware / MUwS basics (icon hiding, device admin abuse)

Families & Kids

• Families Self-Certified Ads SDKs only
• No AAID / location for child-directed apps
• tagForChildDirectedTreatment verification
• Neutral age screens for mixed audiences

Store Listing & Technical

• Target API level requirement
• Metadata policy (title length, emoji, promo language)
• Webview-wrapper / minimum functionality detection
• debuggable, cleartext traffic, committed keystores
• Hardcoded secrets and staging URLs

Quick-Check — Top 10 Play Rejection/Removal Reasons

1. Data safety form mismatch
2. Restricted permissions without declaration
3. Background location without justification
4. Play Billing bypass
5. Missing account deletion
6. Target API level too old
7. Missing privacy policy
8. Families policy violations
9. Disruptive ads
10. Minimum functionality (webview wrappers)

---

Example Reports

Policy Coverage & Versions

Apple and Google update these policies periodically — if you encounter a mismatch, please open an issue or PR.

Contributing

PRs welcome. Here’s how you can help:

• Add checks — Found a rejection reason not covered? Add it to skills/appstore-review/SKILL.md or skills/playstore-review/SKILL.md
• Reduce false positives — Help make detection more precise
• Update guidelines — Apple and Google update their policies periodically
• Share rejection stories — Real-world examples help everyone

License

MIT — see LICENSE

---

Disclaimer: This plugin checks against publicly available Apple and Google policies. It does not guarantee store approval. Always review the official App Store guidelines and Google Play policies before submission.