Security audit

RevenueCat

Security checks across malware telemetry and agentic risk

Overview

This RevenueCat skill appears useful for API access, but it exposes broad live administrative and financial actions without clear scoping or safety gates.

Install only if you intend to give an agent administrative RevenueCat API access, not just analytics lookup. Use the least-privileged/read-only RevenueCat key available, review scripts/rc-api.sh before use, and require manual confirmation before any refund, cancellation, delete, webhook, entitlement, product, project, paywall, or virtual-currency change.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares and encourages shell execution via a local script but does not declare permissions to make that capability explicit. Hidden or undeclared execution capability increases the chance that a caller invokes code without understanding the trust boundary, especially when the script can use a secret API key and perform remote actions. In this context the shell access is operationally necessary, but the missing permission declaration is still a real security and transparency issue.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill is described as query-focused for metrics, customer data, and documentation search, but this reference exposes broad state-changing and administrative endpoints including delete, transfer, entitlement grants, blocking, and virtual currency modification. This creates dangerous capability drift: an agent or downstream orchestrator could invoke high-impact write actions when the user likely expects read-only analytics behavior, increasing the chance of unauthorized account changes or destructive mistakes.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill metadata says it is for RevenueCat metrics, customer data, and documentation search, but this reference file exposes create, update, attach/detach, and delete entitlement operations. That scope expansion increases the chance an agent using this skill could perform configuration-changing actions a user did not intend, especially if the surrounding tool layer does not strictly separate read-only and write capabilities.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file documents creation, modification, and deletion of webhook integrations even though the skill is described as analytics, customer data, and documentation search. That scope expansion enables outbound data exfiltration paths and destructive configuration changes that are unrelated to the declared user intent, increasing the chance of misuse or confused-deputy behavior.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Webhook administration is not justified by the stated purpose of querying metrics, customers, or docs, so the skill exposes capabilities beyond user expectations. In this context, an agent could be induced to create or alter webhooks that send RevenueCat events to attacker-controlled endpoints or disable legitimate delivery.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill metadata describes a query/search-oriented capability, but the referenced documentation exposes create, update, attach/detach, and delete operations for offerings and packages. This mismatch can cause an agent or user to invoke privileged state-changing actions under the assumption the skill is read-only, increasing the risk of unauthorized or accidental configuration changes.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill metadata says it should be used for analytics, customer data, and documentation search, but this file documents state-changing paywall management endpoints including create and delete. That scope expansion can cause an agent or user to treat the skill as read-oriented while it actually enables configuration changes, increasing the risk of unauthorized or unintended modifications to subscription monetization flows.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is described as being for RevenueCat metrics, customer data, and documentation search, but this file documents product creation, deletion, and store-publishing operations. That scope mismatch materially increases the chance an agent could perform unauthorized configuration changes when a user expected read-only analytics behavior, creating a dangerous capability expansion.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented ability to create products, delete products, and push them to external stores is not justified by the stated purpose of an analytics/customer/docs search skill. In an agent setting, this kind of unnecessary privileged functionality raises the risk of accidental or prompt-induced destructive actions affecting live subscription configuration and revenue operations.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is described as supporting RevenueCat metrics, customer data, and documentation search, but this file documents broad administrative capabilities including creating, updating, and deleting apps and projects. That scope expansion is dangerous because an agent or user expecting read-oriented analytics functionality could be induced to perform state-changing actions that alter billing integrations, credentials, or production configuration.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Administrative project and app management operations are exposed even though the manifest frames the skill as analytics/docs oriented. In an agent setting, this mismatch increases the chance of over-privileged use, accidental destructive actions, or prompt-driven abuse that escalates from passive reporting into active infrastructure modification.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill exposes endpoints that retrieve public API keys and StoreKit configuration, and elsewhere accepts highly sensitive integration secrets such as private keys and shared secrets. Even where some values are labeled public, exposing configuration and key-management surfaces in a skill meant for analytics/docs broadens sensitive data access and can aid reconnaissance or leakage.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documented refund action expands the skill from a stated analytics/search use case into a state-changing financial operation. In an agent setting, exposing destructive purchase-management capabilities where users expect read-only metrics increases the chance of unauthorized or unintended refunds, especially if tool selection or user intent is ambiguous.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is described as supporting analytics, customer data, and documentation search, but this reference also exposes destructive mutation capabilities including cancellation and refunds. That scope expansion is dangerous because an agent or downstream integrator may invoke financially impactful actions that users did not intend when they believed they were using a read-oriented subscription analytics skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The authenticated management URL returns a secure single-use portal link that grants temporary account-management access, which exceeds the stated analytics/documentation-search use case. In an agent setting, exposing such links can enable unintended privilege handoff, phishing-like redirection, or unauthorized account changes if the URL is surfaced or mishandled.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The documented API surface includes create, update, and delete operations for virtual currencies, which materially exceeds the stated skill scope of metrics, customer data, and documentation search. This creates a scope/permission mismatch that could enable an agent or user to perform administrative state-changing actions they would not reasonably expect from this skill, increasing the risk of unauthorized or accidental business-impacting modifications.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs use of a secret RevenueCat API key to query customer, subscription, purchase, and metrics endpoints, but provides no warning that these requests can access sensitive business and customer data. Users may invoke the skill without realizing that prompts could trigger remote retrieval or modification of production subscription records through an authenticated API. The risk is elevated because the referenced API domains include customer data and potentially state-changing operations such as refunds or cancellations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The delete-customer operation is presented without any warning that it is destructive or potentially irreversible, despite affecting customer records and associated data. In an agent setting, lack of prominent warnings and confirmation requirements increases the likelihood of accidental execution through ambiguous prompts, automation errors, or prompt-manipulated tool use.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation presents a destructive DELETE entitlement endpoint without any warning about irreversibility, side effects, or recommended confirmation flow. In agent contexts, omission of such guardrails can lead to unsafe automation where a model treats deletion as a routine operation and removes subscription configuration unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The webhook create/update documentation permits specifying arbitrary external URLs and optional authorization headers but provides no warning that events and credentials may be transmitted off-platform. In an agent setting, this omission can cause users or higher-level orchestrators to treat the action as routine configuration rather than a sensitive outbound data transfer.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The deletion endpoint is destructive and can silently stop business-critical event delivery, yet the documentation does not warn about operational impact or reversibility. In an agent workflow, lack of a warning increases the risk of accidental or socially engineered deletion of integrations relied on for billing, analytics, or downstream automation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The offering deletion endpoint is documented as public and deletes an offering along with attached packages, but no caution, confirmation requirement, or rollback guidance is provided. In an agent skill context, absence of friction around destructive actions makes accidental or prompt-induced deletion materially more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The package deletion endpoint removes package configuration without any warning about impact or reversibility. Because packages directly affect subscription offerings, an agent using this endpoint could silently disrupt purchasing flows or entitlements through accidental or manipulated requests.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: Detaching products from a package is a configuration-changing operation that can alter what users can purchase, yet the documentation provides no warning about downstream effects. While less destructive than deletion, it can still break monetization configuration or cause inconsistent product availability if triggered unexpectedly.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation exposes a DELETE paywall endpoint with no cautionary note, confirmation requirement, or safety guidance. In an agent context, especially one presented as analytics/docs focused, undocumented destructive behavior can lead to accidental deletion of paywalls, disrupting purchase flows and revenue generation.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.