revenuecat-testing-setup
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive guide for developers setting up sandbox and testing environments for RevenueCat. It follows industry best practices by instructing users to gate test API keys behind build configurations (e.g., debug vs. release) to prevent exposure in production binaries.
- [SAFE]: All external links point to official developer documentation from trusted and well-known services, including Apple (App Store Connect), Google (Play Console), Amazon Appstore, and Samsung Galaxy Store.
- [SAFE]: The skill uses appropriate placeholders for sensitive information like API keys (e.g.,
test_YOUR_TEST_STORE_KEY,appl_YOUR_PRODUCTION_KEY), encouraging secure development practices rather than hardcoding actual secrets. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to inspect project metadata files (such as
package.json,pubspec.yaml, orbuild.gradle.kts) to detect the development environment. While this involves reading untrusted local data, the purpose is restricted to internal platform detection and does not expose high-risk capabilities. - Ingestion points: The agent reads local project files (
package.json,pubspec.yaml,build.gradle.kts,Package.swift,Podfile) to identify the mobile framework. - Boundary markers: Absent; the agent reads the raw file content to check for specific dependency strings.
- Capability inventory: File system read access (to project metadata) and providing instructions to the user.
- Sanitization: Not applicable as the data is used for simple string matching and logic branching within the skill.
Audit Metadata