The AppEsteem ACR Compliance Skill teaches your AI coding tool (Claude Code, Codex, GitHub Copilot, Gemini CLI, Cursor, or any tool that supports the Agent Skills standard) to review your installer, offer screens, monetization and uninstall flow against the Application Compliance Requirements: the standard AppEsteem certifies against, and the one security vendors draw on.
Install it in one command:
It turns the ACRs into a code-review checklist your agent can actually run. All 131 current requirements, including the 57 Deceptor-level ones, with each requirement's intent, compliance guidance, applicability gates, and the notes AppEsteem gives its own testers.
Writing an installer, offer screen, trial or cancellation flow? The agent applies the requirements while the code is being written, not after the fact.
Every finding cites the ACR id, states the severity, points at the specific code or copy, and gives a concrete fix.
Already flagged, blocked, or listed? Point the agent at your code and it identifies the behaviors that draw AV attention, ordered worst-first.
Install the skill, open your project in your AI coding tool, and paste one of these.
Consumers deserve software that says what it does, does what it says, and leaves when asked. That is the point of the ACRs, and the commercial argument happens to run the same direction.
The requirements are living, so the bundled reference is regenerated weekly by CI from the source of truth: AppEsteem's requirements API. The skill also tells agents to prefer fetching that API live when they have network access, so a review reflects the current standard even between regenerations.
The skill is instructions and reference data only. There is no executable code for your agent to run. It's published by AppEsteem Corporation, which writes the requirements; the tooling is MIT-licensed and the skill content is CC BY 4.0, so it can ship inside other tools' catalogs.
It's built on the open Agent Skills standard, so it works with Claude Code, Codex, GitHub Copilot, Gemini CLI, Cursor and any other tool that supports it. Install it with npx skills add AppEsteem/skills, or copy the skills/appesteem-acr-compliance/ folder into your agent's skills directory. It's instructions and reference data only; there's no executable code for your agent to run.
Dark patterns are what the ACRs have covered for years under names like scare tactics, forced action, and misdirection. Install the skill and ask your coding agent to review your offer screens, upsells, trial-to-paid conversion and cancellation flow. It classifies every applicable requirement as pass, violation, needs human verification, or not applicable, so you get an honest picture rather than a clean bill of health it can't actually give from code alone.
Disclose everything you install before you install it, use one consistent app and company name everywhere including the code signature, never pre-check an offer or make declining harder than accepting, don't claim problems you can't substantiate, and make uninstall remove what you added and revert what you changed. That's the summary; the ACRs are the specifics, and they're free to read. The skill applies them to your installer project directly, so compliance gets checked at build time rather than after a detection.
Security products flag installers for specific behaviors, not for being unknown: undisclosed bundled software, alarming or unsubstantiated system-health claims, offers that are hard to decline, changes that survive uninstall. Because vendors share intelligence, one product's block tends to spread, so disputing it product by product rarely holds while the behavior is still there. Install the skill and point your AI coding tool at your installer project; it maps the code and setup UI against the ACRs and tells you which behaviors are Deceptor-level, the ones vendors act on. Fix those, rebuild, and resubmit through the vendor's false-positive channel; if your app is already on AppEsteem's Deceptor list, the fix has to happen before any dispute will hold.
Sometimes, but far less often than developers assume. PUA (potentially unwanted application) detections usually point at a real behavior in the app: a pre-checked offer, a free scan that reports problems it can't substantiate, a subscription that's hard to cancel, leftovers after uninstall. Run the skill over your code and copy first. If it finds nothing and every requirement passes, you have a much stronger false-positive case to make to the vendor, and a concrete list of what you checked.
PUP (potentially unwanted program) is the same class of detection as PUA under a different vendor's name, and the fix is the same: identify the behavior, remove it, ship a clean build, then dispute with evidence. The 57 Deceptor-level ACRs are the shortlist of behaviors most likely to be behind it. The skill checks all of them against your actual code and copy instead of leaving you to guess.
Store policies on deceptive design overlap heavily with the ACRs: misleading claims, fake urgency, trick buttons, unclear subscription terms, and cancellation flows designed to be difficult. Ask your AI coding tool to review your store listing copy, screenshots, purchase flow and cancellation flow with the skill. Each finding cites the requirement and gives a concrete fix, which usually translates directly into the change the reviewer is asking for.
All free, no account needed. The skill points developers here too, so a review can always be checked against the source.
If violations remain that you can't resolve, if your app is already listed and you need it resolved, or if you need to prove compliance to a third party, AppEsteem offers paid app reviews and certification.