storekit
Warn
Audited by Snyk on Jun 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly a StoreKit 2 in-app purchases/subscriptions integration. It defines purchase flows (e.g., purchase()), transaction lifecycle management (Transaction.updates, Transaction.finish(), Transaction.unfinished), receipt/verification modes (on-device vs App Store Server + JWSTransaction), restore and entitlement-granting behavior, and references the App Store Server API. Those are specific APIs and operations whose primary purpose is executing and finalizing monetary transactions (purchases/subscriptions) and managing receipts — not generic tooling. Therefore it grants direct financial execution capability.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata