CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

rc-security

Use this skill when hardening a RevenueCat integration on Android. Covers Trusted Entitlements response verification (INFORMATIONAL, the default since SDK 8.11.0), why the server is always the authority, API key hygiene (public SDK key vs secret REST key), anonymous user identity, and purchase token protections RevenueCat provides automatically.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./revenuecat-play-billing/skills/rc-security/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable hardening workflow with concrete code and an explicit verification checklist. The main weakness is token efficiency: version-specific facts (SDK 8.11.0 default, SDK 10.x behavior) are repeated multiple times across sections instead of stated once.

Suggestions

State the version-dependent facts once — e.g. a short 'Version notes' or deprecated-patterns section covering the SDK 8.11.0 INFORMATIONAL default and SDK 10.x having no enforced mode — and reference it from Phases 1–3 instead of repeating it three to five times.

Make the server-side example fully executable by defining or stubbing `revenuecat_get` and `parse`, or replacing them with a concrete requests call, so 3.4 is copy-paste ready like the Kotlin sections.

Turn the Phase 4 checklist into a feedback loop by adding one line telling the reader to return to the relevant Phase 3 subsection for any unchecked item before finishing.

DimensionReasoningScore

Conciseness

The body is mostly efficient — dense tables, tight code, no basic-concept padding — but time-sensitive version notes are repeated throughout rather than consolidated: "the default since SDK 8.11.0" appears three times (Phase 1 question, Decision A, Common mistakes) and "SDK 10.x has no enforced mode" appears twice (Decision A and 3.1), which both duplicates information and invites staleness.

3 / 5

Actionability

Guidance is mostly executable: copy-paste-ready Kotlin for configuration, the verification-result when-branch, gating logic, and logIn; the Python server check has minor gaps (undefined `revenuecat_get` and `parse` helpers), and "grep the Android source tree for the secret key prefix" omits the actual prefix pattern.

4 / 5

Workflow Clarity

A clear Intent → Discovery → Plan → Execute → Verify sequence with an explicit Phase 4 checklist ("Secret key grep is clean", "VerificationResult.FAILED is acted on") serving as validation; the gap versus the top anchor is that no error-recovery loop is described for when a checklist item fails.

4 / 5

Progressive Disclosure

No bundle files exist, and the single-file body is well organized with clearly signaled phase headers, decision tables, and an external "Full chapter" link; minor gaps are the two bare mentions of `rc-webhooks` ("see rc-webhooks") which are not resolvable paths in this bundle.

4 / 5

Total

15

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it explicitly states both what the skill covers and when to use it, in a highly distinctive niche with specific technical terminology. Main improvement opportunity is converting topic nouns into concrete actions and broadening the trigger phrases.

DimensionReasoningScore

Specificity

The description names concrete coverage areas — "Trusted Entitlements response verification (INFORMATIONAL, the default since SDK 8.11.0)", "API key hygiene (public SDK key vs secret REST key)", "anonymous user identity", and "purchase token protections" — but they are framed as topics covered ("Covers...") rather than actions performed, leaving minor gaps versus the comprehensive multi-action anchor.

4 / 5

Completeness

Both parts are explicit: the what ("Covers Trusted Entitlements response verification... API key hygiene... anonymous user identity...") and the when ("Use this skill when hardening a RevenueCat integration on Android"). The when clause is explicit but single-phrased rather than listing concrete trigger variations, matching the 'when could be more explicit or specific' anchor.

4 / 5

Trigger Term Quality

Natural phrases a user would say are present — "hardening a RevenueCat integration", "Trusted Entitlements", "API key", "purchase token", "Android" — giving good keyword coverage; a few natural variants (e.g. "secure", "entitlement verification", "receipt validation") are missing, so it is not at the comprehensive-with-synonyms level.

4 / 5

Distinctiveness Conflict Risk

It occupies a clear niche — RevenueCat + Android + security hardening — with distinct triggers ("RevenueCat", "Trusted Entitlements", "public SDK key vs secret REST key") that no generic skill would match; conflict risk is minimal.

5 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

RevenueCat/ai-toolkit

Path

revenuecat-play-billing/skills/rc-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.