Three iOS delivery-verification skills refuse to trust build output — 14 artifact checks

ekinkilickaya95-byte · ghdev · 2026-10-10

A PR to anthropics/skills adds three skills distilled from real iOS shipping work, built to distrust their own intermediate conclusions:

ios-package-gate: the author measured xcodebuild archive printing ARCHIVE SUCCEEDED while the bundle was completely unsigned, so the gate opens the package and runs 14 checks: signature authority, get-task-allow, beta-reports-active, dev-profile detection, architectures, version fields, privacy manifest, icon, declared-vs-actual permissions, and encryption-declaration consistency. Validated across three apps, catching unsigned archives, stripped signatures, and undeclared permissions. A design lesson: an over-strict "no permissions at all" rule falsely flagged a legitimate mic/photo permission; the rule is now "must match declarations."
ios-appstore-native-delivery: the raw xcodebuild path (not Expo/EAS), with four costly traps around automatic signing and upload-vs-installable.
content-language-gate: refuses to equate "scanner found no violations" with "none exist."

More from coding & agent