storekit2-subscriptions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited storekit2-subscriptions (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set up auto-renewable subscriptions in a SwiftUI iOS app end-to-end. This skill ships working Swift templates, a local testing config, and a checklist for App Store Connect — so the user can go from zero to a working purchase flow in about an hour.
Trigger when the user wants to add:
Do not use this skill (yet) for:
If the user needs any of the above, tell them so and offer the v1 scope as a starting point.
By the end, the user's project will contain:
YourApp/
├── Subscriptions/
│ ├── SubscriptionManager.swift (actor: products, purchase, entitlements)
│ ├── TransactionListener.swift (handles updates from outside the app)
│ └── PaywallView.swift (SwiftUI paywall, customization marked)
└── Products.storekit (local config for testing without sandbox)Plus a checklist of App Store Connect steps they need to do themselves (you can't automate those).
Follow these steps in order. Don't skip the interview — getting product IDs wrong is the #1 reason StoreKit setups fail silently.
Ask these questions in one batch (not one at a time):
com.example.myapp) — needed for the .storekit config.com.example.myapp.pro.monthly and com.example.myapp.pro.yearly. If they don't have a preference, propose IDs and confirm.Pro.Subscriptions/ folder at project root unless they specify.Before generating files, confirm:
@main struct conforming to App, not AppDelegate)If any of these are missing, tell the user what they need to do before proceeding. Don't generate files into an incompatible project.
Copy these files from templates/ into the user's project, substituting their values:
templates/SubscriptionManager.swift → Subscriptions/SubscriptionManager.swifttemplates/TransactionListener.swift → Subscriptions/TransactionListener.swifttemplates/PaywallView.swift → Subscriptions/PaywallView.swifttemplates/Products.storekit → project root, with product IDs and prices substituted inSubstitution targets in the templates:
{{BUNDLE_ID}} → user's bundle identifier{{PRODUCT_IDS}} → user's product IDs as a Swift array literal{{SUBSCRIPTION_GROUP}} → user's group nameAfter generating, show the user the diff/files and explain what each one does in one sentence.
Show the user how to:
SubscriptionManager as a @StateObject in their App struct.environmentObject(subscriptionManager)PaywallView from wherever they gate premium featuressubscriptionManager.hasActiveSubscription to gate contentGive a complete code snippet for the App struct showing all of this.
Read references/app-store-connect-checklist.md and walk the user through it. This is manual work they have to do in the App Store Connect web UI — you can't automate it, but you can list every step in order so they don't miss any. Common miss: forgetting to fill in tax/banking info, which silently blocks all purchases.
Tell the user about the three testing modes (read references/testing-guide.md for details):
Recommend they start with the local .storekit file (which the skill already generated) and graduate to sandbox before launch.
Before declaring done, read references/storekit2-gotchas.md and surface the 3 most likely gotchas for this user's setup. Don't dump the whole gotchas doc — pick what's relevant. Examples:
Read these as needed — don't load them all up front.
references/storekit2-gotchas.md — Edge cases that bite people: interrupted purchases, ask-to-buy, family sharing, currentEntitlements vs all, why server validation mattersreferences/app-store-connect-checklist.md — Step-by-step App Store Connect configreferences/testing-guide.md — Local .storekit vs sandbox vs TestFlightBefore declaring done:
hasActiveSubscription flips to true~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.