pp-revenuecat

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill requires installing a CLI by fetching and executing remote code at runtime (e.g., via npx -y @mvanhorn/printing-press-library install revenuecat --cli-only and go install github.com/mvanhorn/printing-press-library/library/payments/revenuecat/cmd/revenuecat-pp-cli@latest), so these external sources are runtime dependencies that execute remote code and are therefore flagged.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a RevenueCat CLI explicitly for subscription/revenue operations and includes commands that perform financial actions. Notably, the "refund-cascade" command can issue refunds ("--apply issues the refund"), and multiple endpoints require read_write permissions (apps, offerings, products, virtual-currencies, customers, entitlements, etc.), meaning the tool can modify billing/monetary state. It also requires a server-side secret API key for auth. Because it is specifically designed to manage revenue and execute refunds, it grants direct financial execution capability.