implement-in-app-purchases
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill uses natural instructional language and does not contain any patterns attempting to override agent behavior, bypass safety filters, or extract system prompts. Bypassing/DAN markers are absent.
- [DATA_EXFILTRATION]: No hardcoded credentials or exfiltration patterns were detected. References to API keys or user IDs in code examples use generic placeholders (e.g., 'YOUR_PUBLIC_SDK_KEY', 'hashed_account_id'). Network operations target trusted Unity Services or well-known payment providers (Stripe, Coda).
- [OBFUSCATION]: No malicious obfuscation (Base64, zero-width characters, homoglyphs) was found. The mention of the 'Receipt Validation Obfuscator' refers to an official Unity Editor tool for legitimate receipt security. Mentions of hex or unicode in documentation are for standard serialization purposes.
- [REMOTE_CODE_EXECUTION]: No remote script execution or unverifiable package installations were detected. The skill relies on official Unity registry packages and standard platform dependencies (Apple StoreKit, Google BillingClient).
- [COMMAND_EXECUTION]: The skill does not instruct the agent to execute dangerous shell commands or perform privilege escalation (sudo/chmod). Analysis is restricted to project file scanning and code generation within the Unity environment.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted project data (source code, manifests, asset files) to determine migration logic, which represents an indirect injection surface. However, this behavior is essential to its function as a developer migration tool, and the capabilities (file modification, code generation) are scoped to the intended project context.
- [PERSISTENCE]: No persistence mechanisms such as shell profile modifications or registry run keys were found.
Audit Metadata