apple-developer-apis
Facilitates integration with Apple Developer APIs for managing apps, subscriptions, and authentication using JWT.
Install this skill
Security score
The apple-developer-apis skill was audited on Feb 9, 2026 and we found 20 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 148 | 'Authorization': `Bearer ${jwt}`, |
Fetch to external URL
| 144 | const response = await fetch( |
Fetch to external URL
| 385 | const response = await fetch('https://appleid.apple.com/auth/token', { |
Fetch to external URL
| 437 | await fetch('https://appleid.apple.com/auth/revoke', { |
Webhook reference - potential data exfiltration
| 8 | webhooks, (3) Creating JWT tokens for Apple API authentication, (4) Managing TestFlight |
Webhook reference - potential data exfiltration
| 23 | - **App Store Server Notifications**: Receive webhook events for subscription lifecycle |
Webhook reference - potential data exfiltration
| 248 | Webhooks for subscription lifecycle events. |
Webhook reference - potential data exfiltration
| 305 | ### Webhook Handler (Node.js) |
Webhook reference - potential data exfiltration
| 525 | 4. **Implement webhook verification** - Validate all incoming notifications |
Webhook reference - potential data exfiltration
| 557 | - See `references/server-notifications.md` - Webhook event structures |
External URL reference
| 106 | **Base URL:** `https://api.appstoreconnect.apple.com/v1` |
External URL reference
| 145 | 'https://api.appstoreconnect.apple.com/v1/apps?fields[apps]=name,bundleId&limit=10', |
External URL reference
| 161 | **Base URL (Production):** `https://api.storekit.itunes.apple.com` |
External URL reference
| 162 | **Base URL (Sandbox):** `https://api.storekit-sandbox.itunes.apple.com` |
External URL reference
| 340 | **Base URL:** `https://appleid.apple.com` |
External URL reference
| 365 | audience: 'https://appleid.apple.com', |
External URL reference
| 385 | const response = await fetch('https://appleid.apple.com/auth/token', { |
External URL reference
| 412 | const client = jwksClient({ jwksUri: 'https://appleid.apple.com/auth/keys' }); |
External URL reference
| 420 | issuer: 'https://appleid.apple.com', |
External URL reference
| 437 | await fetch('https://appleid.apple.com/auth/revoke', { |