revenuecat-store-state
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill is designed for legitimate administrative tasks related to RevenueCat and app store management.- [INDIRECT_PROMPT_INJECTION]: The skill manages a potential indirect prompt injection surface by processing external data from store platforms. It includes mandatory safety controls, specifically requiring a user-visible 'before → after' summary and explicit confirmation for all writes to production environments, which effectively mitigates the risk of autonomous obedience to potentially poisoned external metadata.
- Ingestion points: External product state data is ingested via
get-product-store-state(SKILL.md). - Boundary markers: The instructions mandate a user-confirmed 'before → after' summary (SKILL.md).
- Capability inventory: Product state modifications and store submissions via
set-product-store-stateandsubmit-products-to-store(SKILL.md). - Sanitization: Human-in-the-loop validation via explicit user confirmation before execution.
Audit Metadata