revenuecat
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill integrates with external RevenueCat data such as audience previews, customer attributes, and chart metrics, while possessing the capability to perform state-changing operations via API tools and the
rcCLI. This combination creates an attack surface for indirect prompt injection, where malicious instructions embedded in processed data (e.g., custom attributes or metric names) could attempt to influence the agent's behavior. - Ingestion points: Data enters the agent's context through tools like
preview-audience(AUDIENCES.md),get-chart-data(CHARTS-AND-METRICS.md), and subscriber lookups (BACKEND-AND-WEBHOOKS.md). - Boundary markers: The skill instructs the agent to "Ask the tool, don't guess" and use strict schema-defined IDs, which provides structural separation, although it does not explicitly define delimiters for all interpolated text strings.
- Capability inventory: The agent can create, modify, and delete project entities (apps, products, offerings, and audiences) and execute shell commands through the
rcCLI (CLI-AND-API.md). - Sanitization: The instructions mandate URL-encoding for dynamic filter values (AUDIENCES.md) and rigorous signature verification (HMAC-SHA256) for webhook payloads to prevent tampering (BACKEND-AND-WEBHOOKS.md).
Audit Metadata