purchasely-migrate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The migration explicitly requires rewriting init calls that include Purchasely.apiKey("…") / start(withAPIKey: …) and thus the agent would need to read and re-emit the project's API key (a secret) verbatim into generated code, creating an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The Purchasely migration skill explicitly targets in‑app purchase handling and platform billing integrations. It requires updating Google Play Billing dependencies, maps StoreKit/Google Play purchase flows, and instructs setting the SDK runningMode to Full so Purchasely "processes and validates purchases." The guide documents interceptors for Purchase actions, synchronous purchase handling (including calling native store flows), calling Purchasely.synchronize(), and mapping purchase result types — all of which are specific APIs for initiating and handling real payments via StoreKit / Google Play Billing. This is not generic automation or a general HTTP tool: the primary and explicit purpose is to manage and execute in‑app financial transactions. Therefore it grants Direct Financial Execution Authority.