revenuecat-cli

SUSPICIOUS. The skill’s purpose and requested RevenueCat credentials are broadly coherent, but the core install trust is not established by the provided evidence: it asks the agent to execute and possibly globally install an allegedly official CLI that could not be verified from RevenueCat’s own docs here. Because the skill also feeds a secret API key into that CLI, the unresolved publisher/provenance gap materially raises risk even without clear malicious behavior.