pp-revenuecat

SUSPICIOUS. The skill's main capabilities broadly match its stated RevenueCat operations purpose, and install sources appear same-publisher and documented rather than obviously malicious. Risk comes from the required external CLI, unpinned Go installs, optional posting to arbitrary webhook URLs, and operational commands with real-world effects (including refunds and configuration changes), which make the footprint broader and riskier than a read-only analytics helper.