create-revenuecat-project
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided data to drive the configuration of backend resources via automated tools.
- Ingestion points: User input collected during Phase 1 (Platforms, Business Model, Subscription Tiers, and App Details) in SKILL.md.
- Boundary markers: The instructions do not define explicit delimiters or instructions to treat user-provided strings as untrusted data when interpolating them into tool parameters.
- Capability inventory: The skill uses tools to create projects, apps, products, entitlements, offerings, and packages, and retrieves public API keys (SKILL.md, Phase 2).
- Sanitization: No explicit sanitization or validation logic is specified for the user-provided Bundle IDs or package names before they are used in tool executions.
Audit Metadata