integrating-revenuecat
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install
react-native-purchasesandreact-native-purchases-uivia npm and npx. These are official SDKs from RevenueCat, a well-known service for in-app subscription management.- [COMMAND_EXECUTION]: Documentation suggests executing local project scripts (e.g.,node tools/extract-product-ids.js) to automate identifier extraction. This is a routine developer workflow and involves code expected to be present in the user's own repository.- [PROMPT_INJECTION]: The skill features a surface for indirect prompt injection by ingesting and processing content from the user's application codebase. - Ingestion points: Project files at the provided application path (processed via extraction scripts).
- Boundary markers: None specified for the data extraction process.
- Capability inventory: Shell execution for script running (
node,npm run). - Sanitization: No explicit sanitization or validation of the extracted identifiers is mentioned in the setup instructions.
Audit Metadata