In-App Purchases

• Analyzed: May 12, 2026, 4:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: 554ff6e7ddda1dfbf1f6086eb78fe8d8b86b7d3e281641a771ad13a8355e7011
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle 'in-app-purchases' is benign. It provides comprehensive documentation and code examples for implementing in-app purchases across various platforms (iOS, Android, Flutter) and using different SDKs (RevenueCat, Adapty). The content covers client-side integration, server-side receipt verification, analytics, and testing. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. While the `server.md` file discusses handling sensitive application-level credentials (e.g., Apple App Store Connect private keys, Google service account JSON) for legitimate IAP verification, this is standard practice for secure backend operations and does not indicate malicious intent within the skill bundle itself.