ship-apple-app

Audit and manage the in-app localization of a Capacitor / web-shell app, whose UI strings live in JavaScript and HTML rather than in .strings, .xcstrings or strings.xml. Use whenever such an app needs a language checked, added or fixed, when a screen shows the wrong language or an empty label, when asked to find untranslated or hardcoded UI text, or when handling RTL in a bilingual app ("שפה לא נכונה", "תרגום באפליקציה"). It finds the failure this architecture hides: a lookup that falls back instead of failing, so a missing translation ships silently as the wrong language. For an Xcode project whose strings really are in String Catalogs, use localization-i18n instead — that skill has nothing to work on here. It covers the web layer's strings; native Apple localization is localization-i18n's job.

Tighten existing product copy — App Store / Google Play listing text, marketing and product sites, README marketing sections, in-app strings, replies to store reviews — when it reads clumsily: long sentences, stacked clauses, the same point made twice, throat-clearing openers, jargon the buyer does not know, or a translation that reads as a translation rather than as the language. Use when the user says copy is convoluted, wordy, clunky, unprofessional, hard to read, sounds machine-written, "מסורבל", "מנוסח רע", "נשמע כאילו מודל כתב", or asks to rewrite, tighten, sharpen or polish existing text in any language. This skill EDITS text that already exists; it does not decide what to say. Run it before delivering copy to a store or deploying a site.

Build an app's product profile — the one document every piece of copy about it is later derived from: store listings, site pages, campaigns. Use when onboarding a new app, before writing any copy for it, or when the user asks to "analyze my app", "write up what my app does", "build the marketing profile", "document the app's advantages" ("נתח את האפליקציה", "בנה פרופיל"). It reads the app's source like a product analyst, interviews the owner for what code cannot reveal, researches the real competitors, and proposes a feature and advantage list for the owner to edit before anything is written. Writes `profile.md`, an owner-facing translation beside it, and prepares the media folder. It does NOT capture media (appstore-media does), does NOT write store listing text (store-metadata-writer does), and never writes the app's name or subtitle — those live in the app's README, owned by app-identity.

Decide an app's NAME for both stores, and own the project README as the source of truth for the name, subtitle / short description, and detected feature list. Use when the user wants to name or rename an app, asks "what should I call my app", wants to change the name under the icon or in a store listing, or wants the README's feature list written or refreshed ("תן שם לאפליקציה", "עדכן את ה-README"). Run it when the app is feature-complete, and always BEFORE app-store-metadata, play-store-metadata, aso-keywords and appstore-media, which all read the name and feature list from here. It scans the code for features and monetization, proposes ASO-aware candidates, and DISCUSSES them: it never picks a name on its own. Once decided it writes the display name into the Apple build settings and into Android's strings.xml, and owns the README's version label and changelog. It does NOT write the store metadata files or the keyword field — app-store-metadata, play-store-metadata and aso-keywords own those.

Set up the app factory in a repo, or say why its skills are not loading. Use when a store or release skill that should exist is missing, when the user asks "why aren't the skills loading here", "set up the factory", "enable the tracks", "which tracks does this repo need" ("למה אין לי את הסקילים", "תפעיל את המסלולים"), or after installing the marketplace for the first time. It reads the repo to decide what it is, proposes the tracks that follow, and writes the repo's own .claude/settings.json. It does NOT install plugins, does NOT change the machine's global settings, and does NOT commit — enabling a track is a fact about one repo.

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling or beautifying any web UI; "תעצב את הדף", "שפר את העיצוב"). Generates creative, polished code and UI design that avoids generic AI aesthetics. It does NOT decide a page's structure — `page-builder` does that first — and does NOT audit the result (`web-design-guidelines`).

Take a built macOS app from an Xcode archive, package it into a signed DMG, notarize it with Apple, staple the ticket, and verify that everything — the app AND the DMG — is properly signed and notarized for direct (non-App-Store) distribution. Use this whenever the user wants to ship a Mac app outside the Mac App Store ("נוטריזציה", "קובץ DMG"): build/create a DMG, sign with Developer ID, notarize, staple, fix "app is damaged / can't be opened / unidentified developer" Gatekeeper errors, or verify notarization status. Covers the Developer ID flow only (for Mac App Store builds, that's a different signing path). It signs, notarizes and packages; setting up the Sparkle update channel is macos-direct-distribution's job.

Audit and manage IN-APP localization for a macOS or iOS Xcode project — the user-facing strings inside the app (Localizable.strings / .xcstrings String Catalogs), NOT the App Store listing text. Use this whenever the user wants to localize or translate the app's UI ("תתרגם את האפליקציה", "תוסיף שפה"), add or check a language, find hardcoded (un-localized) strings in Swift, check that all locales have all keys (no missing / empty / untranslated strings), find unused or undefined string keys, migrate to String Catalogs, or handle RTL (e.g. Hebrew) and pluralization. For App Store listing metadata (name/description/keywords per language), that's the separate app-store-metadata skill.

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized `repro_outputs/` files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

When the user wants help with pricing decisions, packaging, or monetization strategy. Also use when the user mentions 'pricing,' 'pricing tiers,' 'freemium,' 'free trial,' 'packaging,' 'price increase,' 'value metric,' 'Van Westendorp,' 'willingness to pay,' 'monetization,' 'how much should I charge,' 'my pricing is wrong,' 'pricing page,' 'annual vs monthly,' 'per seat pricing,' 'should I offer a free plan,' 'pricing page teardown,' 'pricing page audit,' 'is my pricing page AI-readable,' or 'can AI read my pricing.' Use this whenever someone is figuring out what to charge, how to structure their plans, or wants to audit a pricing page (for humans and for the AI agents that shortlist tools). For in-app upgrade screens, see paywalls. For offer construction (bonuses, guarantees, value framing, naming) on services/courses/coaching/high-ticket B2B, see offers.

Audit a website for WCAG 2.1 AA accessibility violations using automated scanning and Noibu traffic data, and optionally draft the fixes. Use when you want to know what's inaccessible across the store, check WCAG or ADA compliance, find contrast or heading errors, audit for screen reader support, generate an accessibility report, or fix accessibility violations with pull requests or tickets.

Audit vercel-plugin performance on real-world projects. Extracts tool calls from Claude Code conversation logs, tests hook matching against actual inputs, identifies pattern coverage gaps, and checks plugin cache staleness. Use when asked to audit, test, or investigate plugin skill injection on a real project.

Read-only PREVIEW of a Snowflake environment from the operator's machine - inventory of tables and views with row counts, byte sizes and column types, plus the census of objects that are not tables or views, table-maintenance state and security posture. Use ONLY when the user wants to look at an account without migrating it - answering what is in there, how big the tables are, what the security posture looks like. This is NOT the discovery step of a migration: a migration discovers inside AIDP as a workflow (runbook S6), because a laptop-side read leaves no log and no evidence on the platform. If the user asked to migrate, route to snowflake-migrator-overview and follow S1 through S12.

Authentication integration guidance — Clerk (native Vercel Marketplace), Better Auth, Descope, and Auth0 setup for Next.js applications, plus Sign in with Vercel, Vercel Passport, and Vercel KMS. Covers server config, route handlers, proxy.ts auth patterns, sign-in/sign-up flows, and Marketplace provisioning. Use when implementing user authentication, sessions, protected routes, or protecting deployments.