rc-webhooks
Use this skill when consuming RevenueCat webhooks on your backend. Covers authenticating requests (Authorization header, optional HMAC signing), parsing the normalized event schema without breaking on new fields, idempotency via the event id field, every event type, and taking access from a re-read of the customer so CANCELLATION, EXPIRATION, and RENEWAL never grant or revoke the wrong access.
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Medium
Suggest reviewing before use
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill documents parsing and processing webhook events from RevenueCat for backend subscription management. It handles state synchronization (entitlements, subscriptions, and consumable credits) in response to events like purchases, cancellations, and renewals. It does not perform any direct financial transfers, charges, or purchases itself, nor does it initiate outgoing financial instructions; it only processes incoming notifications and updates local records. This constitutes an indirect financial operation (managing subscription status and billing records).
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow consumes RevenueCat webhooks, which are HTTP POST requests containing outsider-submitted JSON event payloads read by the agent's application code.
- Repository
RevenueCat/ai-toolkit
- Revision
41a9649
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.