1
Audit
Start with what the agent can read.
Inspect the Xcode project, settings and related code. Keep missing facts Unknown, then ask only questions that could change the findings.
Catch risks early.Fix. Then verify.
Catch iOS review risks before App Store submission.
Give your coding agent a pre-submission review workflow. Turn code and settings into evidence, fix plans and clear next checks.
For Claude Code / Codex / Cursor
Audit
Fix
Verify.
Fix
Verify.
Audit first. Keep the unknowns visible.
Interactive illustrative example. Run a real audit in your coding agent.
SmoothSubmit AuditSampleApp / Release
From audit to verification
Invalid Privacy Manifest type
NSPrivacyTracking is a string. The declaration requires a Boolean.
"NSPrivacyTracking": "false"Evidence: the declaration in PrivacyInfo.xcprivacy.
Still unknown: storefronts / reviewer access
A specific change and recheck plan
Confirm whether the app tracks, then use the appropriate Boolean. This example declares no tracking.
"NSPrivacyTracking": falseChanges need an explicit request. A normal audit does not edit code or settings.
Still unknown: storefronts / reviewer access
Recheck the same condition
The declaration type violation is resolved. Storefronts and reviewer login details still need confirmation.
FAIL → PASS · static checkA setting fix and runtime verification are separate. This does not guarantee approval.
Still unknown: storefronts / reviewer access
ILLUSTRATIVE EXAMPLE
For Claude Code / Codex / Cursor
Public alpha · Apache-2.0v0.1.0-alpha.2
Find out before
Apple has to tell you.
Move beyond a checklist: connect the evidence to a fix plan, then check the result.
2
Fix
Understand the risk. Know what to change.
Get evidence, Apple references and a focused fix prompt for your coding agent. Actual changes happen after you explicitly ask.
3
Verify
Check the same target again.
Compare a fresh audit with the baseline. A vanished finding is not automatically resolved; missing evidence stays on the recheck list.
See the settings.
See what is still unknown.
19 rule families separate supported static checks from conditions that need agent judgment or developer verification.
Privacy & permissions
Privacy Manifest, Required Reason APIs, permission purpose strings, SDK declarations and verification gaps.
Accounts & payments
Account deletion, login alternatives, purchase restoration, subscription display and external payment context.
Submission & review
Reviewer access, privacy policy, metadata, minimum OS, submitted toolchain and agreement preparation.
Does it help?
We checked real code.
We tested pinned public iOS source snapshots, injecting defects into temporary copies to check detection, fix prompts and verification after repair.
| Public project source | Injected defects | Detection → recheck after repair |
|---|---|---|
| IceCubes | 3 | 3 / 3 detected and resolved |
| KeePassium | 3 | 3 / 3 detected and resolved |
| NetNewsWire | 3 | 3 / 3 detected and resolved |
Three defect types per project
Minimum OS setting / Privacy Manifest type / Required Reason API reason code
All 9 deliberately injected setting defects were detected. 57 automated tests also passed. These apps were not built, device-tested or submitted. Rejection-rate improvements and time savings have not been measured.
Three steps to
your first audit.
A Skill adds SmoothSubmit’s audit workflow to your coding agent. No CLI or new API key required. Choose your tool, then follow these steps.
-
-
Download and place the files
Download the Skill for CodexExtract the downloaded archive. Copy the entire smoothsubmit folder into this location inside your iOS project, including references and assets.
Destination inside your iOS project.agents/skills/smoothsubmit/If a Skill already exists there, review the differences before updating it.
-
Ask your coding agent to audit
Open the coding session for the iOS project where you placed the files, then send this prompt.
Invoke $smoothsubmit in Codex.
$smoothsubmit Audit this project with SmoothSubmit
Skill discovery depends on the host version. Live automatic discovery across all three tools is not yet verified. Read the installation guide
More: optional CLI, release details and source code
Before you use it.
Does an audit change my app?
A normal audit does not edit code or app settings, write to App Store Connect or submit your app. Review the proposed fixes, then explicitly request the changes you want.
Where does my code go?
The CLI processes your source locally and does not send it. The Skill uses your coding tool’s model and file access, so that tool’s data settings apply.
How current are the Apple references?
The bundled official sources were checked on 2026-10-07. Findings include references and their knowledge date. Requirements depend on regions, OS and product types; consult the source register before relying on an older release.
Will my app definitely pass review?
No guarantee. SmoothSubmit helps surface configuration gaps and implementation questions before submission. Device, backend and submission-information checks are still needed.