OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass3 providerslatest audit Sep 14, 2026
Independent checks from skills.sh's audit partners.
The skill is functional and follows safety best practices, but it has an indirect prompt injection surface as it processes product metadata from external App Store Connect and RevenueCat APIs. It utilizes the official App Store Connect CLI and RevenueCat MCP server, incorporating robust safety measures such as a read-only audit mode, mandatory user confirmation for write operations, and strict validation gates.
Detected behaviors
No alerts
No issues