The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the Google Play Service Account (SA) JSON to be granted 'GCP project Owner' status. It explicitly instructs the agent to ask the user to elevate the service account's permissions to 'Owner' in the Google Cloud Console. This is an excessive privilege level that grants full administrative control over the entire cloud project, violating the principle of least privilege.
[CREDENTIALS_UNSAFE]: The instructions guide the agent to copy the sensitive Service Account JSON file (play-api-service-account.json), which contains private keys and project metadata, to the system clipboard using the pbcopy command. This practice exposes sensitive credentials to any application or process with clipboard access.
[COMMAND_EXECUTION]: The skill scaffolds and executes multiple Python scripts and shell commands, such as bootstrap_catalog.py, upload_assets.py, and enable-rc-gcp-apis.sh. These scripts are used to perform automated infrastructure changes, including enabling GCP APIs and modifying IAM bindings.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from RevenueCat API documentation and store product configurations to generate catalog and paywall scripts, creating an attack surface for indirect prompt injection.
Ingestion points: RevenueCat REST API responses, catalog.py configuration files, and official RevenueCat documentation.
Boundary markers: The skill includes instructional constraints such as "Never commit secrets" and "Consult official API docs" to guide agent behavior.
Capability inventory: The skill utilizes shell execution, Python script execution, and clipboard manipulation via pbcopy.
Sanitization: There is no evidence of automated sanitization or validation of external API content before it is interpolated into code templates or command-line arguments.
[EXTERNAL_DOWNLOADS]: The skill recommends installing dependencies and related tools using npx skills add from the voys-apps repository and pip3 install pillow for image processing.

rc-launchpad