Pre-Submission Scan

Scan the developer's codebase for common App Store and Google Play rejection triggers. All analysis happens locally — no code leaves the machine. Check definitions are served by the API for up-to-date coverage.

Scan Lifecycle

Execute these steps in order. Each step is a script call or API curl. Do NOT skip steps. Do NOT dispatch subagents.

0. Resolve API Key

Before any authenticated API call, resolve the API key. Check in this order:

1. Run echo $ASR_API_KEY — if non-empty, use that value
2. If empty, read ~/.appstorereject/config.json with the Read tool and extract the apiKey field value

Store the resolved key in your working memory. You will use it directly in curl commands throughout this scan. In every authenticated curl command below, replace $ASR_API_KEY with the actual key value — do NOT rely on the shell env var, because each Bash call runs in a separate shell context and exports do not persist.

If neither source has a key, tell the developer to set up an API key (see hub skill for setup instructions).