rc-security
Use this skill when hardening a RevenueCat integration on Android. Covers Trusted Entitlements response verification (INFORMATIONAL vs ENFORCED), why the server is always the authority, API key hygiene (public SDK key vs secret REST key), anonymous user identity, and purchase token protections RevenueCat provides automatically.
- Installs
- 654
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/revenuecat/ai-toolkit --skill rc-security- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads rc-security automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Phase 0: Intent
Tell the user: "I will review your RevenueCat security posture on Android: verification mode, API keys, user identity, and server side access decisions."
Phase 1: Discovery
Confirm what RevenueCat already covers so you can focus on the real gaps.
| Concern | Who handles it | How |
|---|---|---|
| Receipt validation against Google Play | RevenueCat backend | Runs before awaitPurchase() returns |
| Purchase token reuse | RevenueCat backend | Tokens are deduplicated server side |
| Fabricated purchase tokens | RevenueCat backend | Fails Google Play verification, no entitlement granted |
| HTTPS transport to RevenueCat | SDK | Always on |
| Retry of token post on network failure | SDK | Retries on next app launch |
Ask the project these questions:
- Is
EntitlementVerificationModeset? If not,CustomerInforesponses are trusted without signature checking. - Is the SDK configured with the public Android key (starts with
goog_) or has someone accidentally pasted the secret key into the client? - Are real users identified with
Purchases.logIn(yourUserId), or is the app still relying on anonymous$RCAnonymousID:...? - Do server endpoints that serve premium content verify entitlement server side, or do they trust a client sent flag?
Phase 2: Plan
Decide each of the following before changing code.
Decision A: Entitlement verification mode
| Mode | Failed verification does what | Pick when |
|---|---|---|
DISABLED (default) | No signing happens | Only for quick prototypes |
INFORMATIONAL | Logged, access still granted | You want signal without risking false denials to real users |
ENFORCED | EntitlementInfo.isActive returns false | You accept some false negatives from proxies or VPNs in exchange for a strict client guarantee |
Decision B: Where is the authority?
Even with ENFORCED, the client is not the authority for paid content. Decide whether each premium endpoint:
- Calls the RevenueCat REST API per request, or
- Reads a local
has_entitlementflag driven by RevenueCat webhooks.
Option 2 is cheaper at request time, option 1 has no cache staleness. Pick one, document it, do not mix per endpoint without a reason.
Decision C: User identity
If the app is in production, plan to call Purchases.logIn("your_user_id") with your own authenticated user id. Anonymous ids are device scoped identifiers, not credentials, and are shared across users of the same device.
Phase 3: Execute
3.1 Turn on response verification
Add the mode to PurchasesConfiguration:
PurchasesConfiguration.Builder(context, apiKey)
.entitlementVerificationMode(EntitlementVerificationMode.INFORMATIONAL)
.build()
Read the verification result when you inspect entitlements:
when (customerInfo.entitlements.verification) {
VerificationResult.VERIFIED -> { /* response is authentic */ }
VerificationResult.FAILED -> { /* possible tampering, log and alert */ }
VerificationResult.NOT_REQUESTED -> { /* verification disabled */ }
VerificationResult.VERIFIED_ON_DEVICE -> { /* verified locally */ }
}
Upgrade to ENFORCED once you have telemetry confirming FAILED is rare on real traffic:
.entitlementVerificationMode(EntitlementVerificationMode.ENFORCED)
In ENFORCED, a failed signature flips isActive to false on the affected entitlement.
3.2 Keep API keys in the right place
| Key | Where it lives | What it can do |
|---|---|---|
Public Android SDK key (goog_...) | Embedded in the app binary | Read and purchase for the calling user only |
| Secret REST API key | Your server, secret manager or env var | Full REST API, admin operations, grant entitlements |
In Android code, only the public key appears:
Purchases.configure(
PurchasesConfiguration.Builder(context, "goog_PUBLIC_android_sdk_key").build()
)
Never commit the secret key to the app repo. Grep the Android source tree for the secret key prefix and confirm zero hits before release.
3.3 Identify real users
Call logIn as soon as you have an authenticated user id:
val result = Purchases.sharedInstance.awaitLogIn("your_user_id")
val customerInfo = result.customerInfo
Do not rely on the anonymous id as a credential. It is a device scoped identifier and does not protect purchase history on shared devices.
3.4 Enforce on the server, not on the client
Even with ENFORCED mode, every server endpoint that serves paid content checks entitlement server side:
def get_premium_content(user_id):
info = revenuecat.get_subscriber(user_id)
if not info.entitlements["pro"].is_active:
raise Forbidden()
return content
Or read a local has_pro flag driven by RevenueCat webhooks and check that flag per request.
Phase 4: Verify
- Android source contains only the public SDK key. Secret key grep is clean.
-
EntitlementVerificationModeis set (notDISABLED) and telemetry forVerificationResult.FAILEDis watched. - Real users are identified through
Purchases.logIn. Anonymous ids are only used for pre login flows. - Every paid content endpoint on your server verifies entitlement through the REST API or a webhook driven flag. None trust a client header.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Shipping the secret key in the app | An attacker who decompiles the APK can call admin REST endpoints | Public key in app, secret key only on server |
Leaving mode at DISABLED in production | A man in the middle can forge CustomerInfo responses | Set INFORMATIONAL or ENFORCED |
| Treating the anonymous id as a credential | It is not secret and is shared across users of the same device | Call logIn with your authenticated user id |
Trusting customerInfo from the client on the server | A tampered client can claim any entitlement | Verify on the server via REST API or webhook driven DB |
References
FAQ
What does the rc-security skill do?
Use this skill when hardening a RevenueCat integration on Android. Covers Trusted Entitlements response verification (INFORMATIONAL vs ENFORCED), why the server is always the authority, API key hygiene (public SDK key vs secret REST key), anonymous user identity, and purchase token protections RevenueCat provides automatically.
How do I install rc-security?
Run npx skills add https://github.com/revenuecat/ai-toolkit --skill rc-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/rc-security/ (personal) or .claude/skills/rc-security/ (project).
Which AI agents can use rc-security?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is rc-security safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains rc-security?
It is published by revenuecat in revenuecat/ai-toolkit. It has 654 recorded installs.
More from revenuecat/ai-toolkit
revenuecat-paywall
revenuecat/ai-toolkit
Display a RevenueCat paywall inside an app using the RevenueCatUI SDK. Use when the user asks to add a paywall, show a RevenueCat paywall, present PaywallView, integrate RevenueCatUI, gate a premium screen with a paywall, launch PaywallActivity, call presentPaywall or presentPaywallIfNeeded, or show the dashboard configured paywall UI on iOS, Android, Kotlin Multiplatform, Flutter, or React Native. To create, edit, evaluate, or audit the dashboard paywall itself, use revenuecat-paywall-design.
integrate-revenuecat
revenuecat/ai-toolkit
End-to-end RevenueCat integration — sets up the dashboard side via the RevenueCat MCP or the rc CLI (project, app, public API key) and installs/configures the Purchases SDK in the app. Use when the user asks to add RevenueCat, hook up RevenueCat, add subscriptions or in-app purchases to an app, integrate Purchases, install the RevenueCat SDK, set up a RevenueCat API key, configure Purchases on launch, or set up a brand new RevenueCat integration on iOS, Android, Kotlin Multiplatform, Flutter, or React Native.
revenuecat-purchase-flow
revenuecat/ai-toolkit
Implement the RevenueCat purchase and restore flow. Use when the user asks to buy a package, purchase a subscription, fetch offerings, build the purchase logic behind a custom (hand-coded) paywall, handle purchase errors, detect user cancelled, or restore previous purchases on iOS, Android, Kotlin Multiplatform, Flutter, or React Native.
revenuecat-testing-setup
revenuecat/ai-toolkit
Set up a testing environment for RevenueCat purchases without charging real money. Use when the user says test RevenueCat purchases, sandbox setup, StoreKit configuration file, license tester, how do I test purchases without real money, set up sandbox account, internal testing track, or test paywall on iOS, Android, Kotlin Multiplatform, Flutter, or React Native.
create-revenuecat-project
revenuecat/ai-toolkit
Set up a complete RevenueCat project from scratch — creates apps, products, entitlements, offerings, and packages in the correct order. Use when the user wants to create a new RevenueCat project, configure in-app purchases, set up subscriptions or monetization, or bootstrap IAP infrastructure for iOS, Android, or Web.
revenuecat-troubleshoot
revenuecat/ai-toolkit
Diagnose and resolve RevenueCat integration issues — inspects dashboard configuration through the RevenueCat MCP, walks the SDK debug logs, and covers code-side gotchas. Use when the user says offerings are empty, products not loading, entitlement not active after purchase, paywall won't load, transactions not appearing, customer info shows no entitlements, sandbox purchase not working, an SDK-gated RevenueCat feature not working, or RevenueCat is broken on iOS, Android, Kotlin Multiplatform, Flutter, or React Native. Also use when asked to check or validate the store / product setup.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.