CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

storebound scan: offline rejection-risk scan of the project itself

Browse source 
Detects the stack (native iOS / Android, React Native, Expo, Capacitor, Cordova,
Flutter, Unity, Godot) and the SDKs from a maintained table with versions,
file:line and each vendor's disclosure page, then reports App Store and Google
Play rejection risks with guideline, evidence, fix, severity and skill: 2.1(a)
demo account and placeholder text, 5.1.1(v) account deletion, 4.8 login
services, 3.1.1 restore and outside payments, 3.1.2 subscription info, 5.1.2(i)
ATT, purpose strings, privacy link, privacy manifest, 2.3.10, 2.3.7, 2.3.8, 4.2
web wrappers, 2.5.1, 2.5.5, ATS, export compliance, 1.3 kids ads, review
prompts, privacy labels vs SDKs; Play target SDK 36, delete-account URL, App
access, foreground services, exact alarms, QUERY_ALL_PACKAGES, SMS / call log,
com.example package name.

Proposes Data safety / App Privacy / ATT / privacy manifest answers (detected
file:line or ask owner) as a diff against the config; --write adds only the
detected ones. scan.ignore records owner-accepted findings. MCP tool scan
(read-only), validate includes open findings, desktop Checks tab shows them.
Fixtures for iOS, Android, Capacitor, Unity, Flutter, clean and teaser.
This commit is contained in:
CRTkafa 2026-10-11 23:20:55 +08:00
parent 346d80e07e
commit ae58948abd
109 changed files with 3103 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

17
skills/review-rejections/SKILL.md
View file

@ -10,6 +10,23 @@ Inbox). Quote the guideline number and the reviewer's exact sentence back to the
Never suggest hiding behaviour from reviewers, different builds for review, fake accounts or other manipulative tactics:
they turn a rejection into an account termination.
## 0. Before the next submission: `storebound scan`
`storebound scan` (MCP `scan`, read-only, offline) reads the project itself and lists the rejections the files can
prove, with guideline, evidence (file:line), fix and skill: 2.1(a) demo account and placeholder text, 5.1.1(v) account
deletion, 4.8 Sign in with Apple, 3.1.1 Restore Purchases and outside payment, 3.1.2 subscription info, 5.1.2 ATT,
5.1.1(ii) purpose strings, 5.1.1(i) privacy policy link, privacy manifest (ITMS-91053 / 91061), 2.3.10 other
platforms, 2.3.7 keywords, 2.3.8 "For Kids", 4.2 web wrappers, 2.5.1 UIWebView and private URL schemes, 2.5.5 IPv6,
ATS, export compliance, 1.3 kids ads, 5.6.1 / 3.2.2(x) review prompts, privacy label vs SDKs, and the Play target SDK,
delete-account URL, App access, foreground service, exact alarm, QUERY_ALL_PACKAGES, SMS / call log and package name
rules. After a rejection, run it too: the same cause often hides elsewhere. A finding the owner decided is fine goes
into `scan.ignore` with the reason (never silence one yourself).
Checked at review, not by scan (look at these by hand): crashes and hangs on the reviewer's device (2.1; `store-health`),
links that are dead at review time (`storebound validate` checks the configured URLs), screenshots and description
that do not match the app (2.3, `store-screenshots`), poor or unfinished UI (4.0), "too simple" and spam / template
apps (4.2, 4.3; `portfolio-originality`), IAPs that fail in the sandbox (2.1(b), `store-iap-setup`), privacy policy
content (5.1.1(i), `privacy-policy`), local law (5.2).
## 1. Triage (pick one, say why)
| route | when | what you do |
|---|---|---|