App Store preflight

You say: "Will Apple reject my app?" · "Check my app before I submit."

It does: Reads the app's own project — config, Info.plist, privacy manifest, code — with no credentials, and lists what App Review is certain or likely to reject, each with the guideline, the file and line, and the fix. Then it lists what only a test on a device can prove.

App Store Connect only sees the listing. The most common rejections are in the app: a permission prompt with no reason, accounts that cannot be deleted, a paywall with no restore. This skill finds them before a review cycle is spent.

Running the CLI

node <skill-dir>/scripts/asc.mjs <command> [flags]

<skill-dir> is the directory you loaded this SKILL.md from. Below, asc means that line. Run it from the app's directory, or point at it with --project-root.

1. Run it

asc preflight                       # the project next to the config, or the current directory
asc preflight --project-root ./app  # somewhere else
asc preflight --expo-config         # also evaluate app.config.js/ts (runs `npx expo config`)
asc preflight --json                # one document: findings, notes, manualChecks, signals

No credentials, no network. Exit 4 when something is certain to be rejected, 0 otherwise. The same findings appear first in asc check, under App.

Only use --expo-config when the project has a dynamic app.config.js/ts (preflight says so with app.expo-config.dynamic): it executes the project's config code.

2. Read it as a risk table

Present the result to the user in this order, one line each, with the evidence:

Evidence is file:line or the Info.plist key and where it comes from. A warning is a text search or a dependency, not proof — say "found X, not found Y" rather than "your app has no account deletion". If you cannot point at evidence, label the item Unverified.

3. Fix, or waive with a reason

A finding that does not apply is waived in the config, with a reason — the reason is required and stays visible:

"preflight": {
  "ignore": [{ "id": "app.account-deletion", "reason": "Accounts are created and deleted on our website; the app only signs in." }]
}

An id waives itself and every id under it (app.permission.default-text covers every key). Ask the user before waiving anything; never waive a blocker to get past check.

Then run asc preflight again until nothing is P0.

4. Test what a static read cannot prove

The output ends with Test on a device: trigger every permission prompt and read it, create and delete an account, buy in the sandbox and restore, sign in with the demo account App Review will use. Give the user that list; a clean preflight does not mean these work.

5. Checklists by kind of app

Subscriptions, user-generated content, kids, health, AI features, sign-in: see references/checklists.md. Walk the one that matches the app with the user before the first submission.

Next

The listing side — metadata, screenshots, price, rating, submission — is the appstore-release skill. For the reviewer, asc review-info --draft-notes drafts the App Review notes from the config and what preflight read.

Checked against the App Store Review Guidelines of June 8, 2026.