You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
docs: disclose the services the skills' build and signing tools contact - #91
The data handling step of the Claude plugin directory submission asks: "Does any skill send data to a service other than the declared connectors?" The accurate answer is Yes — listed in README. plugin/README.md said "The plugin contacts no other service", which is true of the MCP server but not of every skill. With the user's approval, the skills run the user's own build and signing tools, and some of those tools send data to Apple.
The README now:
Scopes "sends data only to DeployGate" to the MCP server.
Adds a section on the build and signing tools the skills run. It notes that the skills don't pre-approve these commands, so Claude Code asks first unless the user's permission settings already allow them. It lists what each tool contacts:
Gradle, xcodebuild, and fastlane gym download dependencies and, for iOS, contact Apple to sign the build.
The setup skill's iOS UDID flow (references/ios-udid.md) runs fastlane register_devices and fastlane sigh, which send device UDIDs, device names (which include tester names), and the user's Apple ID and team ID to the Apple Developer Portal.
The ci-setup skill can set up fastlane match, which stores signing certificates and profiles in the storage the user chooses: a Git repository, Google Cloud Storage, or S3.
This is a docs: change; it needs no release, because the directory reads the README from the tracked branch.
Test plan
npm test (484 tests pass)
claude plugin validate ./plugin passes
After merge, re-validate the submission in the portal and answer the data handling questions with: personal data "Reads only", skills sending data elsewhere "Yes — listed in README", retention "Longer", under 18 "No"
The plugin README said the plugin contacts no service but DeployGate,
which is true of the MCP server but not of every skill. With the user's
approval, the setup skill runs fastlane register_devices and sigh, which
send device UDIDs, device names, and the Apple ID to the Apple Developer
Portal; builds contact Apple for signing; and ci-setup can set up
fastlane match storage. Scope the existing statement to the MCP server
and list what the skills' tools send, so the directory submission can
answer that skills send data to services listed in the README.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signing uses the certificates and profiles already on the machine, and
the setup skill's xcodebuild steps don't pass -allowProvisioningUpdates,
so building doesn't inherently contact Apple. Say that the tools reach
the network only for missing dependencies or provisioning profiles. Also
say that fastlane match creates certificates and profiles through the
Apple Developer Portal and stores the certificates' private keys too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Privacy disclosure omits Development builds and their data sharing
plugin/README.md:42
This disclosure omits Development builds, even though the setup flow explicitly supports fastlane sigh --development and states that both Development and Ad Hoc profiles are device-scoped (plugin/skills/setup/SKILL.md:295-297, plugin/skills/setup/references/ios-udid.md:38-44). Users following that Development flow send the same device and account data to Apple, so the privacy documentation should cover both build types.
The setup skill registers tester devices for both Ad Hoc and Development
builds (fastlane sigh --adhoc or --development), and both send the same
device and account data to Apple. The README named only Ad Hoc builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@copilot On the previously missed finding about Development builds (plugin/README.md:42): fixed in 587ff6a. The UDID registration line now covers both Ad Hoc and Development builds, matching the setup skill (fastlane sigh --adhoc or --development).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The data handling step of the Claude plugin directory submission asks: "Does any skill send data to a service other than the declared connectors?" The accurate answer is Yes — listed in README.
plugin/README.mdsaid "The plugin contacts no other service", which is true of the MCP server but not of every skill. With the user's approval, the skills run the user's own build and signing tools, and some of those tools send data to Apple.The README now:
xcodebuild, and fastlanegymdownload dependencies and, for iOS, contact Apple to sign the build.setupskill's iOS UDID flow (references/ios-udid.md) runsfastlane register_devicesandfastlane sigh, which send device UDIDs, device names (which include tester names), and the user's Apple ID and team ID to the Apple Developer Portal.ci-setupskill can set upfastlane match, which stores signing certificates and profiles in the storage the user chooses: a Git repository, Google Cloud Storage, or S3.This is a
docs:change; it needs no release, because the directory reads the README from the tracked branch.Test plan
npm test(484 tests pass)claude plugin validate ./pluginpasses🤖 Generated with Claude Code