revenuecat
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices and its operations are consistent with its intended use as a development tool for payment integration.
- [EXTERNAL_DOWNLOADS]: Downloads SDKs and references documentation from well-known and trusted organizations, including RevenueCat, Apple, and Replit. All external resources are retrieved from official domains or package registries.
- [DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of administrative scripts (such as
seedRevenueCat.ts) within the user's workspace to automate the setup of RevenueCat entities. This behavior is restricted to the local development environment and is intended for automation. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the RevenueCat API and external research to provide pricing and configuration suggestions.
- Ingestion points: Data retrieved via
@replit/revenuecat-sdk(e.g., product lists, customer info) and external competitive research from the App Store. - Boundary markers: Not explicitly defined in the provided script templates.
- Capability inventory: The agent can perform file writes, package installations via
pnpm, and script execution usingtsx. - Sanitization: External data is used within administrative scripts for configuration and logging without specific escaping or filtering mechanisms.
Audit Metadata