The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes external data including project configuration files (such as package.json, pubspec.yaml, and build.gradle) and SDK debug logs provided by users. These sources could theoretically contain malicious instructions designed to influence the agent's behavior, especially since the skill has the capability to modify RevenueCat dashboard configurations via its MCP tools.
Ingestion points: Local project manifest files (Step 1 in SKILL.md) and user-provided debug logs (Step 2 in SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present when processing these inputs.
Capability inventory: The skill can execute dashboard modifications using tools like attach-products-to-entitlement and attach-products-to-package.
Sanitization: There is no evidence of sanitization for the data read from project files or logs before it is processed by the agent.
[COMMAND_EXECUTION]: The instructions direct the agent or user to execute several standard development and debugging commands, including adb logcat, flutter clean, pod install, and npx expo prebuild. These are legitimate tools for the skill's purpose but involve interaction with the local shell environment.

revenuecat-troubleshoot