expo-revenuecat-superwall-integration
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive and secure implementation patterns for integrating RevenueCat and Superwall. It emphasizes proper secret management by instructing the use of public API keys in the client and stable, non-PII identifiers for user accounts.
- [SAFE]: The provided Python script
scripts/validate_expo_setup.pyserves as a local diagnostic tool for checking project configuration (e.g., dependencies, SDK versions, and environment variables). The script uses standard library modules for local file reading and regex processing, with no network capabilities or dynamic code execution found. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by auditing project files like
package.jsonand.envto validate the environment. While this creates an attack surface, the risk is negligible due to the script's read-only nature and lack of external communication capabilities. Evidence chain: Ingestion points include project configuration files read by the validation script; capability inventory confirms the script is limited to local file access and text processing; no sanitization issues are present as the script performs specific regex checks rather than executing file contents.
Audit Metadata