revenuecat

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill configures a remote MCP at https://mcp.revenuecat.ai/mcp which is used at runtime to provide tools that control agent behavior, and also suggests running curl -fsSL https://raw.githubusercontent.com/RevenueCat/rc-claude-code-plugin/main/install.sh | bash which fetches and executes remote code during setup/installation; both are runtime external dependencies that can control prompts or execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for subscription/payment management: it names Stripe as the payment processor, exposes RevenueCat APIs/MCP tools for creating products/packages, contains client code that calls Purchases.purchasePackage (initiates a purchase), and processes purchase-related webhooks (INITIAL_PURCHASE, RENEWAL, BILLING_ISSUE). These are specific financial/subscription execution actions (not generic API or browser tooling).