TestFlight

Distribute iOS and macOS beta builds with TestFlight, tester management, and CI/CD automation.

Security Scan

The skill's instructions match its TestFlight purpose, but it references and expects multiple secrets/CI env vars without declaring them and includes CI keychain handling patterns that can be risky if misused — the inconsistencies merit caution before installing/using.

Purpose & Capability

Name and description (TestFlight distribution, tester management, CI/CD) align with the content of SKILL.md and ci-cd.md. All commands and examples (fastlane, xcrun altool, keychain operations, GitHub/GitLab CI snippets) are coherent for uploading builds and automating TestFlight distribution on macOS.

Instruction Scope

Instructions stay within TestFlight/CI setup scope and do not direct the agent to read unrelated system files or contact non-Apple endpoints. They do, however, instruct creating keychains, importing certificates, writing API key files, and echoing base64-decoded secrets into the workspace — behavior that is expected for CI automation but sensitive. The SKILL.md/ci-cd.md do not instruct any exfiltration, but they give the agent broad discretion to handle secrets in the workspace (e.g., echoing secrets to files).

Install Mechanism

Instruction-only skill with no install spec or included code files. Lowest disk/write risk from the skill itself — it does not download or execute third-party installers. All potentially executed tools (fastlane, security, xcrun) are standard macOS/CI tooling and are expected for this purpose.

Credentials

The skill declares no required env vars, yet both SKILL.md and ci-cd.md repeatedly reference multiple sensitive environment variables/secrets (APPSTORE_API_KEY / api_key.json, APPSTORE_API_KEY_ID, APPSTORE_API_ISSUER_ID, P12_PASSWORD, P12_BASE64, PROVISION_BASE64, FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD, etc.). Those secrets are legitimate for TestFlight automation, but the omission from the skill metadata is an inconsistency: the agent/platform cannot automatically know which secrets will be needed. The CI examples also write secrets to disk (api_key.json, cert.p12, profiles), and they create/unlock a keychain with an empty password in examples — practices that can expose secrets on shared runners if not tightly controlled.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent presence or modify other skills. Autonomous invocation is allowed (platform default), which is normal for skills, but combine that with the environment concerns above (sensitive secrets) when granting autonomous access.

What to consider before installing

This skill is instruction-only and otherwise coherent for TestFlight automation, but it expects several sensitive CI secrets and certificate files even though the registry metadata lists none. Before installing or running it, ensure you: 1) do not commit .p8/.p12 or decoded secret files into repos or logs; 2) store APPSTORE API keys, P12 and provisioning profiles in your CI secret store (not plaintext), and prefer the App Store Connect API key over app-specific passwords as suggested; 3) restrict runner access and avoid using shared/public runners when decoding private keys or unlocking keychains with empty passwords; 4) verify Fastlane and tooling versions you’ll run; and 5) be cautious if you let an autonomous agent execute these steps — confirm it will not upload workspace files or secrets to any non-Apple endpoint. The main technical issue is a metadata/declared-env mismatch (the skill should list the env vars it requires); if the publisher can provide a corrected metadata listing required secrets or clarify where secrets are expected, that would reduce risk. If you want, I can list the exact env vars and files referenced so you can pre-configure them in your CI secrets.

When to Use

User needs to distribute beta builds via TestFlight. Agent handles App Store Connect setup, tester groups, build uploads, and CI/CD integration.

Quick Reference

Topic	File
CI/CD automation	ci-cd.md

Core Rules

1. App Store Connect Setup First

Before uploading:

• Bundle ID registered in Developer Portal
• App created in App Store Connect
• App-specific password or API key configured

2. Build Requirements

Every TestFlight build needs:

• Unique build number (CFBundleVersion) - increment ALWAYS
• Valid provisioning profile (App Store distribution)
• No missing compliance declarations

3. Tester Group Strategy

Group	Purpose	Limit
Internal	Team members with App Store Connect access	100
External	Beta testers, requires review	10,000

Internal builds available immediately. External requires Apple review (24-48h first time).

4. Upload Methods

Method	Best For
Xcode	Manual, one-off uploads
xcrun altool	Scripts, CI without fastlane
Fastlane	Full automation, multiple apps
Xcode Cloud	Apple-native CI/CD
Transporter	GUI for non-developers

5. Build Expiration

TestFlight builds expire after 90 days. Plan releases accordingly.

TestFlight Traps

• Build number not incremented - rejected immediately, must bump and rebuild
• Missing export compliance - stuck in "Processing" until answered in App Store Connect
• External testers on first build - requires full beta review, use internal first
• Expired provisioning profile - upload fails silently, check before archiving
• App-specific password in CI - use App Store Connect API key instead (more secure, no 2FA issues)

CI/CD Quick Setup

App Store Connect API Key (Recommended)

1. App Store Connect > Users > Keys > App Store Connect API
2. Generate key with "App Manager" role
3. Download .p8 file (only shown ONCE)
4. Note: Issuer ID, Key ID

Fastlane Upload

# In Fastfile
lane :beta do
  build_app(scheme: "MyApp")
  upload_to_testflight(
    api_key_path: "fastlane/api_key.json",
    skip_waiting_for_build_processing: true
  )
end

xcrun altool (No Fastlane)

xcrun altool --upload-app \
  --type ios \
  --file "MyApp.ipa" \
  --apiKey "KEY_ID" \
  --apiIssuer "ISSUER_ID"

Security & Privacy

Data that leaves your machine:

• IPA/app binary uploaded to Apple servers
• Build metadata (version, bundle ID, team)

Data that stays local:

• API keys and certificates (keep in Keychain)
• Source code (not uploaded)

This skill does NOT:

• Store Apple credentials in plain text
• Share builds outside Apple's infrastructure

Related Skills

Install with clawhub install <slug> if user confirms:

• ios — iOS development patterns
• xcode — Xcode workflows
• flutter — cross-platform builds

Feedback

• If useful: clawhub star testflight
• Stay updated: clawhub sync