integrating-revenuecat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes example code that embeds API keys as string literals (e.g., PurchasesConfiguration('goog_api_key_here')), which encourages the LLM to handle or output verbatim secret/API key values rather than using secure mechanisms like environment variables, creating an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document is a RevenueCat (in-app purchases/subscriptions) integration guide and explicitly exposes APIs that perform monetary transactions: e.g., Purchases.purchasePackage(...), RevenueCatUI.presentPaywall(), Purchases.restorePurchases(), and configuration with API keys. These are specific, purpose-built methods to initiate and manage purchases/subscriptions (i.e., move money via app store billing), so it grants direct financial execution capability.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)