purchasely-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly instructs the agent to scan source files for literal API keys and produce file/line evidence and code before/after fixes, which can require reading and potentially outputting secret API key values verbatim, creating a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly centered on Purchasely — an in-app purchases / subscription SDK — and repeatedly references programmatic purchase APIs and purchase flows. The prompt names concrete purchase-related functions and behaviors (e.g., "purchaseWithPlanVendorId", "Purchasely.purchase", "Programmatic purchase patterns", handling PresentationActionKind.purchase, Observer vs Full purchase handling, running billing → Purchasely.synchronize(), promotional-offer purchase parameters). This is not a generic tool: it is specifically about initiating and validating purchases/subscriptions and routing in-app payment flows, which are direct financial execution capabilities.