Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/rorkai/app-store-connect-cli-skills --skill asc-aso-audit- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads asc-aso-audit automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
asc ASO audit
Run a two-phase ASO audit: offline checks against local metadata files, then keyword gap analysis via Astro MCP. When available, include Apple-generated app tags as a discoverability signal.
Preconditions
- Metadata pulled locally into canonical files via
asc metadata pull --app "APP_ID" --version "1.2.3" --dir "./metadata". - If metadata came from
asc migrate exportorasc localizations download, normalize it into the canonical./metadatalayout before running this skill. - For Astro gap analysis: app tracked in Astro MCP (optional — offline checks run without it).
- For Apple-generated discoverability tags:
asc app-tags list --app "APP_ID" --output jsonworks when the API returns tags for the app.
Before You Start
- Read
references/aso_rules.mdto understand the rules each check enforces. - Identify the latest version directory under
metadata/version/(highest semantic version number). Use this for all version-level fields. - The primary locale is
en-USunless the user specifies otherwise.
Metadata File Paths
- App-info fields (
subtitle):metadata/app-info/{locale}.json - Version fields (
keywords,description,whatsNew):metadata/version/{latest-version}/{locale}.json - App name: May not be present in exported metadata. If
nameis missing from the app-info JSON, fetch it viaasc apps info listor ask the user. Do not flag it as a missing-field error.
Phase 1: Offline Checks
Run these 5 checks against the local metadata directory. No network calls required.
1. Keyword Waste
Tokenize the subtitle field (and name if available). Flag any token that also appears in the keywords field — it is already indexed and wastes keyword budget.
Severity: ⚠️ Warning
Example: "quran" appears in subtitle AND keywords — remove from keywords to free 6 characters
How to check:
- Read
metadata/app-info/{locale}.jsonforsubtitle(andnameif present) - Read
metadata/version/{latest-version}/{locale}.jsonforkeywords - Tokenize subtitle (+ name):
- Latin/Cyrillic scripts: split by whitespace, strip leading/trailing punctuation, lowercase
- Chinese/Japanese/Korean: split by
、,,or iterate characters — each character or character-group is a token. Whitespace tokenization does not work for CJK. - Arabic: split by whitespace, then also generate prefix-stripped variants (remove ال prefix) since Apple likely normalizes definite articles. For example, "القرآن" in subtitle should flag both "القرآن" and "قرآن" in keywords.
- Split keywords by comma, trim whitespace, lowercase
- Report intersection (including fuzzy matches from prefix stripping)
Optional: App Tag Alignment
App tags are Apple-generated labels that can appear in search results and product pages. They are not editable ASO metadata, but they are useful evidence for whether Apple's classification matches the intended positioning.
asc app-tags list --app "APP_ID" --output json
asc app-tags view --app "APP_ID" --id "TAG_ID" --output json
Use tags as context only:
- If visible tags reinforce the subtitle/keyword strategy, note the alignment.
- If tags point to an unintended category or use case, recommend metadata/category changes that may improve future classification.
- Do not promise that changing metadata will immediately change Apple-generated tags.
Optional: Official Apple Search Plan
When both App Store Connect and Apple Ads credentials are configured, use the experimental, read-only plan to join the selected metadata with official paid search evidence:
asc optimize search plan \
--app "APP_ID" \
--version "1.2.3" \
--ad-account "AD_ACCOUNT_ID" \
--country "US" \
--genre "PRODUCTIVITY_UTILITIES" \
--locale "en-US" \
--out-dir ".asc/optimization/1.2.3" \
--output markdown
- Authenticate App Store Connect with
asc authand Apple Ads separately withasc ads auth login; the two credential sets are independent. - Treat the generated CSV and JSON files as review artifacts. The command does not apply metadata, exact keywords, or negative keywords, and partial Apple Ads source failures stay visible in the report.
- Keep Apple's popularity, app-specific paid reach, paid search outcomes, and metadata coverage distinct. Do not infer organic rank or keyword difficulty from this plan.
2. Underutilized Fields
Flag fields using less than their recommended minimum:
| Field | Minimum | Limit | Rationale |
|---|---|---|---|
| Keywords | 90 chars | 100 | 90%+ usage maximizes indexing |
| Subtitle | 20 chars | 30 | 65%+ usage recommended |
Severity: ⚠️ Warning
Example: keywords is 62/100 characters (62%) — 38 characters of indexing opportunity unused
3. Missing Fields
Flag empty or missing required fields: subtitle, keywords, description, whatsNew.
Note: name may not be in the export — only flag it if the app-info JSON explicitly contains a name key with an empty value.
Severity: ❌ Error
Example: subtitle is empty for locale en-US
4. Bad Keyword Separators
Check the keywords field for formatting issues:
- Spaces after commas (
quran, recitation) - Semicolons instead of commas (
quran;recitation) - Pipes instead of commas (
quran|recitation)
Severity: ❌ Error
Example: keywords contain spaces after commas — wastes 3 characters
5. Cross-Locale Keyword Gaps
Compare keywords fields across all available locales. Flag locales where keywords are identical to the primary locale (en-US by default) — this usually means they were not localized.
Severity: ⚠️ Warning
Example: ar keywords identical to en-US — likely not localized for Arabic market
How to check:
- Load keywords for all locales
- Compare each non-primary locale against the primary
- Flag exact matches (case-insensitive)
6. Description Keyword Coverage
Check whether keywords appear naturally in the description field. While Apple does not index descriptions for search, users who see their search terms reflected in the description are more likely to download — this improves conversion rate, which indirectly boosts rankings.
Severity: 💡 Info
Example: 3 of 16 keywords not found in description: namaz, tarteel, adhan
How to check:
- Load
keywordsanddescriptionfor each locale - For each keyword, check if it appears as a substring in the description (case-insensitive)
- Account for inflected forms: Arabic root matches, verb conjugations (e.g., "memorizar" ≈ "memorices"), and case declensions (e.g., Russian "сура" ≈ "суры")
- Report missing keywords per locale — recommend weaving them naturally into existing sentences
- Do NOT flag: Latin-script keywords in non-Latin descriptions (e.g., "quran" in Cyrillic text) — these target separate search paths
Phase 2: Astro MCP Keyword Gap Analysis
If Astro MCP is available and the app is tracked, run keyword gap analysis. Run this per store/locale, not just for the US store — keyword popularity varies dramatically across markets.
Steps
-
Get current keywords: Call
get_app_keywordswith the app ID to retrieve tracked keywords and their current rankings. -
Check multi-store tracking: Query existing tracking for each locale's App Store territory. Report untracked stores as unavailable and continue the audit. Use
add_keywordsonly when the user separately authorizes tracking setup; empty rankings for an untracked store do not prove poor performance. -
Extract competitor keywords: Call
extract_competitors_keywordswith 3-5 top competitor app IDs to find keyword gaps. This is the highest-value Astro tool — it reveals keywords competitors rank for that you don't. Run this per store when possible. -
Get suggestions: Call
get_keyword_suggestionswith the app ID for additional recommendations based on category analysis. -
Check current rankings: Call
search_rankingsto see where the app currently ranks for tracked keywords in each store. -
Diff against metadata: Compare suggested and competitor keywords against the tokens present in
subtitle,name(if available), andkeywordsfields from the local metadata. -
Surface gaps: Report all gaps ranked by popularity score (highest first). Include the source (competitor analysis vs. suggestion).
Cross-Field Combo Strategy
When recommending keyword additions, consider how single words combine across indexed fields (title + subtitle + keywords). For example:
- Adding "namaz" to keywords when "vakti" is already present enables matching the search "namaz vakti" (66 popularity)
- Adding "holy" to keywords when "Quran" is in the subtitle enables matching "holy quran" (58 popularity)
Flag high-value combos in recommendations.
Skip Conditions
- Astro MCP not connected → skip with note: "Connect Astro MCP for keyword gap analysis"
- App not tracked in Astro → skip with note: "Add app to Astro with
mcp__astro__add_appfor gap analysis" - Store not tracked for a locale → report the gap and skip its rankings; tracking setup requires separate authorization
Output Format
Present results as a single audit report. The report covers only the latest version directory.
### ASO Audit Report
**App:** [name] | **Primary Locale:** [locale]
**Metadata source:** [path including version number]
#### Field Utilization
| Field | Value | Length | Limit | Usage |
|-------|-------|--------|-------|-------|
| Name | ... | X | 30 | X% |
| Subtitle | ... | X | 30 | X% |
| Keywords | ... | X | 100 | X% |
| Promotional Text | ... | X | 170 | X% |
| Description | (first 50 chars)... | X | 4000 | X% |
#### Offline Checks
| # | Check | Severity | Field | Locale | Detail |
|---|-------|----------|-------|--------|--------|
| 1 | Keyword waste | ⚠️ | keywords | en-US | "quran" duplicated in subtitle |
**Summary:** X errors, Y warnings across Z locales
#### Keyword Gap Analysis (Astro MCP)
| Keyword | Popularity | In Metadata? | Suggested Action |
|---------|-----------|--------------|-----------------|
| quran recitation | 72 | ❌ | Add to keywords |
#### Recommendations
1. [Highest priority action — errors first]
2. [Next priority — keyword waste]
3. [Utilization improvements]
4. [Keyword gap opportunities]
Notes
- Offline checks work without any network access — they read local files only.
- Astro gap analysis is additive — the audit is useful even without it.
- Run this skill after
asc metadata pullto ensure canonical metadata files are current. - For keyword-only follow-up after the audit, prefer the canonical keyword workflow:
asc metadata keywords diff --app "APP_ID" --version "1.2.3" --dir "./metadata"asc metadata keywords apply --app "APP_ID" --version "1.2.3" --dir "./metadata" --confirmasc metadata keywords sync --app "APP_ID" --version "1.2.3" --dir "./metadata" --input "./keywords.csv"when importing external keyword research
- After making changes, re-run the audit to verify fixes.
- The Field Utilization table includes promotional text for completeness, but no check validates its content (it is not indexed by Apple).
FAQ
What does the asc-aso-audit skill do?
Run an offline ASO audit on canonical App Store metadata under ./metadata and surface keyword gaps using Astro MCP. Use after pulling metadata with asc metadata pull.
How do I install asc-aso-audit?
Run npx skills add https://github.com/rorkai/app-store-connect-cli-skills --skill asc-aso-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/asc-aso-audit/ (personal) or .claude/skills/asc-aso-audit/ (project).
Which AI agents can use asc-aso-audit?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is asc-aso-audit safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains asc-aso-audit?
It is published by rorkai in rorkai/app-store-connect-cli-skills. It has 6,212 recorded installs.
More from rorkai/app-store-connect-cli-skills
asc-cli-usage
rorkai/app-store-connect-cli-skills
Guidance for using asc cli in this repo (flags, output formats, pagination, auth, and discovery). Use when asked to run or design asc commands or interact with App Store Connect via the CLI.
asc-release-flow
rorkai/app-store-connect-cli-skills
Orchestrate App Store releases with asc, including staging a version, uploading or building an artifact, publishing, and submitting for review. Use when the user wants to prepare or execute a release. Keep Game Center item preparation in this skill; route other readiness failures, stuck submissions, cancellation, and retry decisions to asc-submission-health.
asc-submission-health
rorkai/app-store-connect-cli-skills
Diagnose App Store submission blockers and operate review health with asc, including readiness validation, repair routing, status monitoring, cancellation, and retry decisions. Use when validation fails, a version is not in a valid state, review status is unclear or stuck, or a failed submission must be repaired and retried. For staging, upload, publication, and submission execution, use asc-release-flow.
asc-metadata-sync
rorkai/app-store-connect-cli-skills
Sync, validate, and apply App Store metadata and store assets with asc. Use when updating localizations, keywords, App Clip or preview assets, Asset Library media and placements, or migrating legacy fastlane metadata.
asc-xcode-build
rorkai/app-store-connect-cli-skills
Build, archive, export, and manage Xcode version/build numbers with asc, including portable iOS compilation and packaging. Use when creating an IPA or PKG for App Store Connect, TestFlight, or registered-device release testing.
asc-id-resolver
rorkai/app-store-connect-cli-skills
Resolve App Store Connect IDs (apps, builds, app and digital-goods versions, groups, testers) from human-friendly names using asc. Use when commands require IDs.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.
