The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses standard instructional language and checklists to guide the developer. There are no attempts to override agent behavior, bypass safety filters, or extract system prompts.
[DATA_EXFILTRATION]: No network requests to non-whitelisted domains or patterns for harvesting sensitive files (such as SSH keys or AWS credentials) were found. The mentioned network operations refer to official Apple StoreKit 2 APIs (e.g., Product.products, AppStore.sync).
[OBFUSCATION]: The content is entirely in plain text. No Base64, zero-width characters, homoglyphs, or other obfuscation techniques were detected.
[REMOTE_CODE_EXECUTION]: The skill does not include any commands to download and execute scripts from remote sources. It focuses on native Swift code for the StoreKit framework.
[COMMAND_EXECUTION]: The shell commands provided (find, rg) are intended for local code inspection by the developer to verify implementation compliance and do not present a security risk.
[CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or secrets are present. The mention of appAccountToken refers to a standard UUID-based security feature for associating transactions with user accounts.
[DYNAMIC_EXECUTION]: There is no use of eval(), exec(), or dynamic script generation that could lead to unauthorized code execution.
[PERSISTENCE]: No mechanisms for establishing persistence, such as modifying shell profiles or creating scheduled tasks, are included.

axiom-in-app-purchases