firebase-flutter-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed secrets verbatim (Authorization: Bearer $ACCESS_TOKEN in curl and sending clientSecret in the PATCH JSON, plus placeholders for SDK/API keys placed directly into code/manifest), which requires the LLM/agent to handle or output secret values directly and risks exfiltration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes RevenueCat IAP setup: creating entitlements, offerings, obtaining an SDK key, and updating the Flutter app to enable in-app purchases/subscriptions. RevenueCat is a monetization/payment backend specifically designed to handle purchase/subscription flows (i.e., money-moving operations). While AdMob is present only for ad display (no budget APIs shown), the RevenueCat integration is a specific payment-related tool and therefore qualifies as direct financial execution capability.