revenuecat-entitlements-gate
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate implementation guides for integrating RevenueCat SDKs across various mobile platforms. It correctly identifies platforms by checking standard project files (e.g., package.json, pubspec.yaml, Podfile) and provides platform-specific code snippets for both one-shot checks and reactive listeners.
- [DATA_EXPOSURE]: The skill correctly advises against hardcoding product IDs or sensitive information, recommending the use of entitlement identifiers configured in the RevenueCat dashboard. It also correctly notes that the SDK must be configured with an API key elsewhere, avoiding hardcoded secrets in these snippets.
- [INDIRECT_PROMPT_INJECTION]: The skill has a low attack surface for indirect injection as it primarily provides static code templates. The only user-influenced data is the 'entitlement identifier' (e.g., 'premium'), which is used as a key in a map lookup, a safe operation.
- [COMMAND_EXECUTION]: The skill mentions command-line tools like 'flutter logs', 'logcat', and 'npx expo' for verification purposes only. It does not contain instructions for the agent to execute arbitrary or dangerous shell commands.
- [EXTERNAL_DOWNLOADS]: The skill references official RevenueCat GitHub release pages and documentation for dependency management. These are well-known, trusted sources and do not constitute a security risk.
Audit Metadata