implement-in-app-purchases
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructions focus on Unity development workflows and API implementation. No attempts to override agent behavior, bypass safety filters, or extract system prompts were found.
- [DATA_EXPOSURE]: The skill does not access sensitive local file paths (like SSH keys or AWS credentials). It uses standard placeholders for API keys (e.g., 'YOUR_PUBLIC_SDK_KEY') and recommends secure practices like using Unity Authentication for D2C payments. No hardcoded secrets were detected.
- [OBFUSCATION]: No hidden content, zero-width characters, homoglyphs, or multi-layer encoding techniques were found in the provided files.
- [REMOTE_CODE_EXECUTION]: The skill references standard, well-known packages from the official Unity registry (e.g., 'com.unity.purchasing', 'com.unity.services.core'). It does not use 'curl | bash' patterns or other unsafe remote execution methods. Mentioned third-party services like Stripe and Coda are established payment providers.
- [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file does not contain any dynamic context injection patterns (such as the exclamation-backtick shell command syntax).
- [INDIRECT_PROMPT_INJECTION]: The skill processes local configuration files (JSON, CSV, YAML) for product catalogs and project settings. It does not ingest untrusted remote data that could lead to prompt injection vulnerabilities.
- [SAFE]: All external URLs and resources trace back to official Unity domains or trusted GitHub organizations (Unity-Technologies). The skill's behavior strictly matches its stated purpose of assisting with Unity IAP development.
Audit Metadata