iap-finalizer
Warn
Audited by Snyk on Aug 2, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill explicitly uses the App Store Connect API to set in-app purchase prices and price schedules (e.g. GET pricePoints and POST /v1/inAppPurchasePriceSchedules with an --apply flag). Those are specific, write-capable payment-related API calls that change product pricing (which directly affects customer charges). This is not a generic browser or HTTP helper — the skill is purpose-built to perform store-side pricing updates.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata