shiny-inapppurchases
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill provides clear guidance on using official vendor libraries for in-app purchases.
- [INDIRECT_PROMPT_INJECTION]: The skill documents endpoints for processing external data (IAP receipts and webhooks from Apple and Google). While this represents a data ingestion surface, the skill correctly instructs developers to use cryptographic verification (JWS) and server-side validation to mitigate risks. 1. Ingestion points: MapInAppPurchaseWebhooks and MapInAppPurchaseVerification endpoints in SKILL.md. 2. Boundary markers: Not explicitly detailed in the documentation's high-level code snippets. 3. Capability inventory: The suggested implementation performs database updates (db.Grant and db.Revoke) and network calls to store APIs (IAppleStoreClient and IGooglePlayClient) in SKILL.md. 4. Sanitization: Implementation relies on platform-level cryptographic verification of signed purchase data.
Audit Metadata