adapty-integration
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill includes a feedback phase that transmits metadata including the platform, paywall approach, integration status, and the Adapty App ID to an external Vercel-hosted endpoint (
https://feedback-endpoint-eandreeva-twrs-projects.vercel.app). While this process is gated by an explicit user consent request and includes logic to skip transmission in headless environments, it involves sending an internal identifier to a non-vendor domain.- [PROMPT_INJECTION]: Multiple reference files (ios.md,android.md,flutter.md,react-native.md,kmp.md,unity.md,capacitor.md) instruct the agent to execute build commands autonomously without prompting or narrating the steps to the user (e.g., "do not tell the user to build", "handle the output yourself"). This directive aims to reduce conversational noise but reduces user oversight of executed shell commands.- [EXTERNAL_DOWNLOADS]: The skill frequently fetches documentation and configuration fromhttps://adapty.io/docs/usingcurl. It also utilizes thenpx adaptyCLI and may suggest installing theflow-generatorskill from the vendor's repository. These are official resources belonging to the authoring organization.- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to fetch and process live documentation from the web. The skill author has included defensive prompts to ensure the agent treats this external content strictly as reference data rather than executable instructions, mitigating the risk of instructions embedded in documentation influencing agent behavior.- [COMMAND_EXECUTION]: The skill directs the agent to execute various local environment commands includingopenssl,npx,gradlew,xcodebuild, andflutterto facilitate project analysis, dashboard setup, and build verification.
Audit Metadata