Skills
Navigate
skills/zakariaf/reactnative-skills/in-app-purchases/Gen Agent Trust Hub

in-app-purchases

Warn

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/check-purchase-behaviour.mjs and its utility scripts/lib/app-modules.mjs utilize module.registerHooks and import() to dynamically load and execute TypeScript modules from the user's project directory. This is used to run project-specific logic (like reducers and services) within the verification environment.
  • [CREDENTIALS_UNSAFE]: The template file templates/scripts/asc/asc-credentials.ts includes logic to read sensitive Apple API private keys from the standard path ~/.appstoreconnect/private_keys/AuthKey_<id>.p8. While intended for legitimate development use, this constitutes direct access to highly sensitive credential files.
  • [EXTERNAL_DOWNLOADS]: The App Store Connect client in templates/scripts/asc/asc-client.ts uses the fetch API to transmit requests, including authentication tokens, to api.appstoreconnect.apple.com for product management operations.
  • [COMMAND_EXECUTION]: The testing utility templates/scripts/storekit/storekit-harness.ts uses execFileSync and spawn to execute a wide array of system commands and development tools, including xcodebuild, npx expo, ruby, and the maestro E2E test runner.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 18, 2026, 11:22 AM