iap-finalizer

Warn

Audited by Snyk on Aug 2, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill explicitly uses the App Store Connect API to set in-app purchase prices and price schedules (e.g. GET pricePoints and POST /v1/inAppPurchasePriceSchedules with an --apply flag). Those are specific, write-capable payment-related API calls that change product pricing (which directly affects customer charges). This is not a generic browser or HTTP helper — the skill is purpose-built to perform store-side pricing updates.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 2, 2026, 01:18 PM
Issues
1
Security Audit — snyk — iap-finalizer