revenuecat
RevenueCat metrics, customer data, and documentation search. Use when querying subscription analytics, MRR, churn, customers, or RevenueCat docs.
Savant verdict: Unsafe
Savant's security policy blocks importing this skill.
Live evaluation
Not evaluated yet. Workspaces can request a live evaluation.
Security assessment
Risk score
71/100
Recommendation
DO NOT INSTALL
Severity
HIGH
Savant decision
Blocked
The security assessment advises against importing or installing this package. Static security analysis completed.
37 patterns found
- Tool Misuse: DELETE /projects/{project_id}/customers/{customer_id}high · references/customers.md:43 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/customers/blocked_customers/{customer_id}high · references/customers.md:307 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/entitlements/{entitlement_id}high · references/entitlements.md:38 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/integrations/webhooks/{webhook_integration_id}high · references/integrations.md:46 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/offerings/{offering_id}high · references/offerings.md:41 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/packages/{package_id}high · references/offerings.md:129 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/paywalls/{paywall_id}high · references/paywalls.md:38 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/products/{product_id}high · references/products.md:51 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/apps/{app_id}high · references/projects.md:83 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Tool Misuse: DELETE /projects/{project_id}/virtual_currencies/{virtual_currency_code}high · references/virtual-currencies.md:40 · Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Structure
- Ships 1 executable scriptscripts/rc-api.sh. Review what they do before enabling the skill for agents with tool access.
- The source hub's security checks flagged this skillSnyk: warn (Risk: MEDIUM · No issues); Runlayer: warn (2/16 files flagged)
SKILL.md
---
name: revenuecat
description: RevenueCat metrics, customer data, and documentation search. Use when querying subscription analytics, MRR, churn, customers, or RevenueCat docs.
license: MIT
metadata:
{
"openclaw":
{
"emoji": "😻",
"requires": { "bins": ["curl"], "env": ["RC_API_KEY"] },
"primaryEnv": "RC_API_KEY",
},
}
---
# RevenueCat
Query RevenueCat metrics and search documentation.
## Config
Set `RC_API_KEY` environment variable, which should be a v2 secret API key.
## Context
Query the RevenueCat API (`GET /projects`) to get information about the project you have access to. Your RevenueCat API key allows access to a single project. Use the project ID in subsequent API calls.
## API Access
```bash
{baseDir}/scripts/rc-api.sh <endpoint>
```
Example: `{baseDir}/scripts/rc-api.sh /projects` to list projects.
## Local API Reference
Start with `{baseDir}/references/api-v2.md` for auth, pagination, and common patterns. Then load the domain file you need:
| Domain | File | Covers |
| ------------------ | ---------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Customers | `references/customers.md` | CRUD, attributes, aliases, entitlements, subscriptions, purchases, invoices, virtual currencies, actions |
| Subscriptions | `references/subscriptions.md` | List, get, transactions, cancel, refund, management URL |
| Products | `references/products.md` | CRUD, create in store, test prices |
| Offerings | `references/offerings.md` | Offerings, packages, package products |
| Entitlements | `references/entitlements.md` | CRUD, attach/detach products |
| Purchases | `references/purchases.md` | List, get, refund, entitlements |
| Projects | `references/projects.md` | Projects, apps, API keys, StoreKit config |
| Metrics | `references/metrics.md` | Overview metrics, charts, chart options |
| Paywalls | `references/paywalls.md` | Paywall creation |
| Integrations | `references/integrations.md` | Integrations CRUD |
| Virtual Currencies | `references/virtual-currencies.md` | Virtual currencies CRUD |
| Error Handling | `references/error-handling.md` | Error handling |
| Rate Limits | `references/rate-limits.md` | Rate limits |
Only load the reference file relevant to the current task — don't load them all.
## Remote Documentation Search
The RevenueCat documentation is available at https://www.revenuecat.com/docs. Use https://www.revenuecat.com/docs/llms.txt and /sitemap.xml as a guide to the content that is available. Add .md to the end of a documentation URL to get the markdown version of the page.