storekit

Warn

Audited by Snyk on Aug 23, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly about in-app payments and subscription management using Apple's StoreKit 2 APIs. It documents and shows direct calls that initiate monetary actions: Product.purchase(...) (the API to perform purchases) and Transaction.beginRefundRequest(...) (to initiate a refund request), plus other purchase/entitlement lifecycle functions (transaction.finish, AppStore.sync for restore, subscription management flows). These are specific payment-related APIs (not generic browser/API helpers) that directly execute or initiate money-related operations.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 23, 2026, 09:00 PM
Issues
1
Security Audit — snyk — storekit