adapty-integration

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill includes a feedback phase that transmits metadata including the platform, paywall approach, integration status, and the Adapty App ID to an external Vercel-hosted endpoint (https://feedback-endpoint-eandreeva-twrs-projects.vercel.app). While this process is gated by an explicit user consent request and includes logic to skip transmission in headless environments, it involves sending an internal identifier to a non-vendor domain.- [PROMPT_INJECTION]: Multiple reference files (ios.md, android.md, flutter.md, react-native.md, kmp.md, unity.md, capacitor.md) instruct the agent to execute build commands autonomously without prompting or narrating the steps to the user (e.g., "do not tell the user to build", "handle the output yourself"). This directive aims to reduce conversational noise but reduces user oversight of executed shell commands.- [EXTERNAL_DOWNLOADS]: The skill frequently fetches documentation and configuration from https://adapty.io/docs/ using curl. It also utilizes the npx adapty CLI and may suggest installing the flow-generator skill from the vendor's repository. These are official resources belonging to the authoring organization.- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to fetch and process live documentation from the web. The skill author has included defensive prompts to ensure the agent treats this external content strictly as reference data rather than executable instructions, mitigating the risk of instructions embedded in documentation influencing agent behavior.- [COMMAND_EXECUTION]: The skill directs the agent to execute various local environment commands including openssl, npx, gradlew, xcodebuild, and flutter to facilitate project analysis, dashboard setup, and build verification.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 09:08 AM
Security Audit — agent-trust-hub — adapty-integration