# Content Moderation Api

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-cruisediary-apple-app-review-skills-content-moderation-api`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [cruisediary](https://agentstack.voostack.com/s/cruisediary)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [cruisediary](https://github.com/cruisediary)
- **Source:** https://github.com/cruisediary/apple-app-review-skills/tree/main/skills/ugc/content-moderation-api

## Install

```sh
agentstack add skill-cruisediary-apple-app-review-skills-content-moderation-api
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Skill: Content Moderation API

## Purpose
Detects absence of a content moderation service integration for apps that accept user-uploaded media or posts, enforcing Guideline 1.2's requirement for timely response to content reports.

## Apple Guideline
- **Primary:** 1.2 — Safety: User Generated Content
- **Related:** 5.1.1(ii)
- **Reference:** `references/guidelines/1-safety.md`

## Real-World Rejection Cases
- **Case:** Image-sharing app with no content moderation — reviewer uploaded test image, flagged as objectionable, no moderation response
  **Source:** Apple Developer Forums
  **Root cause:** 1.2 requires timely response to content reports; no moderation backend means inability to comply — reviewer demonstrated the gap by submitting a test report with no visible effect

- **Case:** Video sharing app rejected — users could upload videos that were immediately public with no pre-publication moderation or post-report takedown mechanism
  **Source:** Apple Developer Forums (Guideline 1.2 rejection threads, multiple reports 2022–2023)
  **Root cause:** For video/media UGC apps, Apple expects either pre-publication screening or a visible and functional post-publication reporting mechanism with timely follow-through. Guideline 1.2 explicitly states apps must "have a mechanism for users to flag objectionable content" and "take action against objectionable content."

- **Case:** Social app had a moderation backend but it only processed text content — profile photos and user bio fields had no moderation — rejected
  **Source:** Apple Developer Forums (Guideline 1.2 rejection threads)
  **Root cause:** Guideline 1.2 compliance applies to all user-generated surfaces in the app, not only the primary feed. Reviewers test all UGC vectors including profile photos, bios, and display names. Partial coverage of only one content type is insufficient.

## Trigger
Invoke on any iOS/macOS project that allows users to upload images, videos, text posts, or comments.

## Inputs
| Name | Type | Default | Description |
|------|------|---------|-------------|
| `project_root` | path | cwd | iOS/macOS project root |
| `shared_context` | object | nil | Pre-collected context from appstore-full-audit Phase 1 |

## Actions

### Phase 1: Context Collection
*Skip this phase if `shared_context` is provided.*

1. `Glob` `**/*.swift` — collect all Swift source files.
2. `Glob` `**/*.plist` — collect property list files for API key references.
3. `Glob` `**/*.json` — collect configuration files for moderation service configuration.

### Phase 2: Checks

1. **Moderation service integration**
   `Grep` pattern `"perspective"|"openai"|"AWS Rekognition"|"rekognition"|"Hive"|"moderationAPI"|"contentModerat"|"sightengine"|"Clarifai"` in `**/*.swift`.
   If none found, flag → 🟠 HIGH. No recognized moderation service integration detected.

2. **Media upload without moderation call**
   `Grep` pattern `uploadImage|uploadMedia|postContent|uploadVideo|uploadFile` in `**/*.swift`.
   For each match, `Read` surrounding context — if no nearby call to a moderation API or no moderation flag check, flag → 🟠 HIGH. Media should be scanned before or immediately after upload.

3. **Publisher contact reachability**
   `Grep` pattern `"contactEmail"|"supportEmail"|"contactUs"|"support@"|"help@"` in `**/*.swift`.
   If absent → 🟡 MEDIUM. Apple reviewers expect a visible, reachable contact method for content issues. Absence may raise questions about developer responsiveness to reports.

### Phase 3: Output
Collect all findings from Phase 2 and build the prioritised findings list below. Include file paths and line numbers. Omit tiers with no findings.

## Output Format

```
## Content Moderation API — Findings

### 🔴 CRITICAL — Guaranteed rejection
- [ ] TODO:  — `file:line` — Guideline 1.2

### 🟠 HIGH — Very likely rejection
- [ ] TODO: Integrate a content moderation service (e.g., AWS Rekognition, Google Perspective, OpenAI Moderation API) — no moderation backend detected — Guideline 1.2
- [ ] TODO: Add moderation check after uploadImage call — uploaded content is not scanned for objectionable material — `MediaUploadService.swift:88` — Guideline 1.2

### 🟡 MEDIUM — Possible rejection
- [ ] TODO: Add a visible support/contact email address accessible in-app so reviewers and users can reach the moderation team

### 🟢 LOW — Best practice
- [ ] TODO: Implement pre-upload client-side hashing against known objectionable content databases (PhotoDNA equivalent) for additional protection
```

## Tools Used
`Glob`, `Grep`, `Read`

## Constraints
- Read-only. No file edits.
- No network calls.
- Skip Phase 1 if `shared_context` is provided by orchestrating agent.
- Works on Swift, Objective-C, React Native, Flutter projects.

## Quick Commands

Run these in your project root to check manually:

```bash
# Check for moderation service integration
!grep -rn "moderat\|perspective\|rekognition\|hive\|contentFilter" . --include="*.swift" -i

# Check for media upload without moderation
!grep -rn "uploadImage\|uploadMedia\|uploadVideo\|postContent" . --include="*.swift"

# Check for publisher contact info
!grep -rn "contactEmail\|supportEmail\|support@\|contactUs" . --include="*.swift"
```

## Swift Anti-Pattern Reference
`examples/swift/UGCSafetyPatterns.swift`

## Detection Steps

1. **Find target files**
   - Glob: `**/*.swift`, `**/*.m`, `**/Podfile`, `**/Package.swift`

2. **Search for rejection patterns**
   - Grep `perspectiveAPI\|contentModeration\|filterContent\|moderateText\|ContentModeration` — moderation backend
   - Grep `profanity\|obscenity\|inappropriate\|ProfanityFilter` — client-side filter
   - Grep `EULAAccepted\|termsAccepted\|agreedToTerms\|TermsAccepted` — terms acceptance flow
   - Grep `userGeneratedContent\|UGCContent\|postContent` — UGC submission path

3. **Determine verdict**
   - UGC submission path found + no moderation integration → 🟠 HIGH (Guideline 1.2)
   - Moderation present + no terms acceptance → 🟡 MEDIUM
   - Moderation + terms acceptance present → 🟢 pass

4. **Report**
   - UGC submission code without moderation
   - Fix: Integrate content moderation API (e.g., Perspective API, AWS Rekognition) or implement server-side filtering; add EULA acceptance before first UGC post

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [cruisediary](https://github.com/cruisediary)
- **Source:** [cruisediary/apple-app-review-skills](https://github.com/cruisediary/apple-app-review-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-cruisediary-apple-app-review-skills-content-moderation-api
- Seller: https://agentstack.voostack.com/s/cruisediary
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.