RevenueCat

RevenueCat metrics, customer data, and documentation search. Use when querying subscription analytics, MRR, churn, customers, or RevenueCat docs.

This skill appears to do exactly what it says: it issues GET requests to RevenueCat using the RC_API_KEY. Before installing, confirm the skill's origin (source/homepage are unknown) and only provide a least-privilege RevenueCat API key (a v2 secret scoped to the needed project). Treat RC_API_KEY as sensitive: rotate/revoke it if the skill is removed or if you suspect misuse. If you need stricter control, test the skill with a throwaway or read‑only API key and avoid exposing production keys until you’re comfortable with its behavior. Finally, be aware the skill can call the RevenueCat API whenever invoked (agent autonomous invocation is allowed by default).

Type: OpenClaw Skill Name: revenuecat Version: 1.0.3 The skill bundle is classified as suspicious due to a shell injection vulnerability in `scripts/rc-api.sh`. The `ENDPOINT` variable, which is passed as an argument to the script, is directly interpolated into a `curl` command without proper sanitization. This could allow an attacker to execute arbitrary shell commands by crafting a malicious `endpoint` value. While the `SKILL.md` instructions do not explicitly exploit this, the vulnerability presents a significant risk for remote code execution if the AI agent receives untrusted input for the endpoint parameter. The `RC_API_KEY` is handled appropriately, being sent only to the legitimate RevenueCat API.