Skills
skills/revenuecat/ai-toolkit/rc-plan-changes/Gen Agent Trust Hub

rc-plan-changes

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Provides Kotlin code snippets using the RevenueCat SDK (Purchases.sharedInstance.awaitPurchase) to perform subscription operations on Android.
  • [EXTERNAL_DOWNLOADS]: References official technical documentation from the vendor's website (revenuecat.com).
  • [PROMPT_INJECTION]: The skill handles data from external billing sources via the activeSubscriptions field, which represents a potential indirect prompt injection surface.
  • Ingestion points: customerInfo.activeSubscriptions in SKILL.md.
  • Boundary markers: None; uses standard SDK programmatic access.
  • Capability inventory: SDK purchase execution via awaitPurchase in SKILL.md.
  • Sanitization: Employs programmatic string manipulation (substringBefore(":")) to extract expected product identifiers from the subscription string.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 09:53 PM
Security Audit — agent-trust-hub — rc-plan-changes