rc-launchpad

SUSPICIOUS rather than malicious. The skill is broadly aligned with RevenueCat monetization operations and routes data mainly to official services, but it has a large operational footprint: remote skill installation, transitive skill trust, high-value API/webhook secrets, and especially guidance to use a GCP project Owner service account. Those factors make it higher-risk than a narrow API helper even without clear exfiltration or covert behavior.