storekit
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill mandates the use of StoreKit 2's async APIs and enforces strict cryptographic verification by requiring that all
VerificationResultobjects be unwrapped and that.unverifiedresults be rejected. - [SAFE]: It establishes a 'Trust the Server' architecture, advising that entitlements should be granted based on server-to-server validation (App Store Server API and Notifications V2) rather than relying solely on the device's signal, which protects against local tampering.
- [SAFE]: The implementation guidelines protect user privacy and security by using
appAccountToken(a UUID) to link purchases to internal accounts instead of using raw user IDs or PII in network requests. - [SAFE]: It correctly identifies supply chain and secret management risks by instructing developers to never store signing keys (.p8) or offer-signing logic within the application binary, keeping them exclusively on the server.
- [SAFE]: The skill promotes exhaustive state handling for purchases, including mandatory transaction finishing to prevent stalled queues and proper handling of deferred states like 'Ask to Buy'.
Audit Metadata