Claude code

Skill atharvnaik1/ipaship-audit/wrappers/claude-code

Let your AI Agent review your iOS/Android apps for appstore policy & security bugs with ipaShip's web app, cli, mcp or claude-skill with safety hooks layer any any llm agent you use - loopin fixes in dev stage only no more waits till submissions.

Install

npx -y skills add atharvnaik1/ipaship-audit --skill claude-code

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use when auditing iOS/Android app submissions for compliance with Apple App Store Review Guidelines or Google Play Developer Policies. Scan .ipa, .apk, or .zip files against official store policies, generate structured compliance reports, and identify violations with remediation steps.

SKILL.md

6.1 KB, as published. Nobody here has run it

ipaShip — ipaship-audit

Audit your iOS/Android app packages against official store policies before submission. Upload .ipa or .apk files and get a structured compliance report with guideline references, severity ratings, and actionable fixes.

When to Use

Before submitting an iOS app to the Apple App Store — catch rejections early
Before submitting an Android app to Google Play — identify policy violations
During CI/CD to automate pre-submission compliance checks
When reviewing third-party apps for compliance risks
As part of a code review workflow for mobile apps

Setup

Prerequisites

Requirement	Details
Account	ipaship.com — free to use
API Key	Get yours at ipaship.com
App Package	`.ipa` (iOS), `.apk` (Android), or `.zip` file (max 150MB)
Dependencies	The server needs `unzip` installed

Environment Variables

export IPASHIP_API_KEY="your-api-key-here"

Usage

1. Web Interface (No Code Required)

Go to ipaship.com
Upload your .ipa or .apk file
Select your AI provider (Claude, GPT, Gemini, or OpenRouter)
Click "Audit" and wait for the streaming report

2. CLI via cURL

# Basic audit with default provider (Anthropic Claude)
curl -X POST https://ipaship.com/api/audit \
  -H "Authorization: Bearer $IPASHIP_API_KEY" \
  -F "file=@/path/to/your-app.ipa" \
  -F "provider=anthropic" \
  -F "model=claude-3-5-sonnet-20241022"

# With context about your app
curl -X POST https://ipaship.com/api/audit \
  -H "Authorization: Bearer $IPASHIP_API_KEY" \
  -F "file=@/path/to/your-app.ipa" \
  -F "provider=anthropic" \
  -F "model=claude-3-5-sonnet-20241022" \
  -F "context=This is a social media app with user-generated content"

# Using OpenAI
curl -X POST https://ipaship.com/api/audit \
  -H "Authorization: Bearer $IPASHIP_API_KEY" \
  -F "file=@/path/to/your-app.apk" \
  -F "provider=openai" \
  -F "model=gpt-4o"

3. Python Wrapper

# wrappers/python/ipaship.py
from ipaship import audit_app

result = audit_app(
    file_path="build/YourApp.ipa",
    provider="anthropic",
    model="claude-3-5-sonnet-20241022",
    api_key="your-key"
)
print(result)

4. Programmatic — All Language Wrappers

The repo ships wrappers in 15+ languages under wrappers/:

Language	Path	Status
Python	`wrappers/python/ipaship.py`	✅
Node.js	`wrappers/npm/index.js`	✅
Go	`wrappers/go/ipaship.go`	✅
Rust	`wrappers/rust/src/main.rs`	✅
Ruby	`wrappers/ruby/lib/ipaship.rb`	✅
Java	`wrappers/java/`	✅
Kotlin	`wrappers/kotlin/`	✅
Swift	`wrappers/swift-cocoapods/`	✅
Flutter/Dart	`wrappers/flutter-dart/`	✅
PHP	`wrappers/php/`	✅
C++	`wrappers/cpp/`	✅
C# (.NET)	`wrappers/csharp-dotnet/`	✅
R	`wrappers/r/`	✅
Expo	`wrappers/expo/`	✅
Homebrew	`wrappers/homebrew/`	✅

Features

Supported AI Providers

Provider	Models
Anthropic	Claude Sonnet 4, Claude 3.5 Sonnet, Claude 3 Opus
OpenAI	GPT-4o, GPT-4o-mini
Google Gemini	Gemini 2.5 Flash, Gemini 2.0 Pro
OpenRouter	Any model (e.g., `anthropic/claude-3.5-sonnet`)
ipaShip (NVIDIA)	Llama 3.1 405B, NVIDIA NIM models

Audit Report Structure

Every report includes:

Executive Summary — What the app does (from code analysis)
Dashboard — Risk level (LOW/MEDIUM/HIGH), readiness score, issue counts
Phase 1: Policy Compliance — Per-guideline checks with PASS/WARN/FAIL
Phase 2: Remediation Plan — Prioritized fix table with file references
Submission Readiness — Go/no-go verdict with score

Key Capabilities

Multi-provider AI — Choose your preferred LLM backend
Real-time streaming — Watch the audit generate live
IPA & APK support — Both iOS and Android
Export — Download as Markdown or PDF
Zero-trust — Files deleted after analysis, API keys stay client-side
Rate limited — 5 requests/minute per client (DDoS protection)

Common Pitfalls

Forgetting unzip — The server needs unzip installed to extract packages. If you see extraction errors, install it: sudo apt-get install unzip.
File too large — Maximum upload size is 150MB. For larger apps, trim the .ipa/.apk first.
No source files found — Ensure your app package isn't encrypted or DRM-protected. The auditor only analyzes readable source code (.swift, .java, .kt, etc.).
API key in the wrong place — The server uses NVIDIA_KEY or NEXT_PUBLIC_API_KEY env vars for the backend. For BYOK (bring your own key), pass it in the upload form.
Binary-only apps — Apps compiled without source code (e.g., Unity builds with only IL2CPP binaries) will have few files to analyze. The audit quality depends on available source.

Verification

After setting up:

Deploy the app locally: npm run dev
Upload a test .ipa or use the cURL command above
Verify you get a streaming JSON response starting with {"type":"meta","filesScanned":N}
Check that the final report includes both Phase 1 (compliance checks) and Phase 2 (remediation plan)
Test with different providers by changing the provider field