backend
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill consists of documentation and code snippets intended to guide developers through integrating a legitimate service (RevenueCat).
- [CREDENTIALS_UNSAFE]: The skill demonstrates secure credential handling by using placeholders (e.g., 'sk_...') and environment variable retrieval ('System.getenv') for sensitive API keys and webhook secrets. It explicitly warns against hardcoding secrets in client bundles.
- [EXTERNAL_DOWNLOADS]: The skill references official RevenueCat API endpoints (api.revenuecat.com). These are standard service interactions for the stated purpose of the skill.
- [COMMAND_EXECUTION]: The code examples provided are limited to standard HTTP requests and simple webhook logic within a Ktor server context, with no evidence of arbitrary command execution or privilege escalation.
Audit Metadata