Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CarolaneLFBV/ios-development-agents --skill ios-storekitgit clone --depth 1 https://github.com/CarolaneLFBV/ios-development-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/carolanelfbv/ios-development-agents/ios-storekit)<a href="https://agentmods.dev/skills/carolanelfbv/ios-development-agents/ios-storekit"><img src="https://agentmods.dev/badge/skills/carolanelfbv/ios-development-agents/ios-storekit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/carolanelfbv/ios-development-agents/ios-storekit"><img src="https://agentmods.dev/badge/skills/carolanelfbv/ios-development-agents/ios-storekit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.00468 |
| Opus 5.5 | $0.00008 | $0.00187 |
| Sonnet 5.5 | $0.00004 | $0.00094 |
| Haiku 4.5 | $0.00002 | $0.00047 |
Grade A, and why
ios-storekit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
In-app purchases and subscriptions
Inspect supported OS versions, product types/IDs, the existing purchase provider, entitlement ownership and any server integration. Preserve a working SDK/provider unless replacement is requested. Check current Apple/provider API contracts.
- Handle success, pending, user cancellation and failures separately. Unlock content only from verified transaction/entitlement state, never a button response, local Boolean or unverified payload. Make product delivery idempotent.
- Observe transaction updates with explicit app/service ownership and cancellation, starting early enough to receive unfinished or external transactions. A listener tied only to a paywall's visibility misses app-lifetime events. Handle same-device purchase results as well as updates without double delivery.
- Call
finish()after delivering content or enabling the service successfully. A failed delivery needs recovery, not premature acknowledgement. - Reconcile current access on launch and relevant updates. Distinguish consumables, non-consumables, non-renewing and auto-renewable subscriptions. Current entitlements do not restore a consumable balance; non-renewing duration needs business policy.
- Respect revocation, upgrades and subscription states such as billing grace periods.
A renewal being cancelled does not alone end access immediately. Do not reduce
every entitlement decision to
expirationDate > nowor an auto-renew Boolean. - Provide an appropriate user-initiated restore path; do not force store sync on every launch. Keep server notifications/credentials and authority explicit when subscription status is shared across platforms.
Use StoreKit configuration tests and sandbox/device checks as appropriate, including pending completion, duplicate delivery, restart, restore, refund/revocation and failed verification. Report which environment actually ran; local StoreKit tests do not establish production/server behavior. Work directly without recursive delegation.
Read the matching Apple contracts when needed: entitlements, updates, delivery acknowledgement.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 40 lines · 21 tokens per session scan A 8237db683b88
ios-storekit is a skill published in the GitHub repository CarolaneLFBV/ios-development-agents (7 stars, last pushed yesterday), licensed MIT. It adds 21 tokens to every session and 468 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-17.
Other skills, from other repositories
play-billing-library-version-upgrade
Use this skill when upgrading or migrating an Android project from any legacy Google Play Billing Library (PBL) version to the latest stable version of PBL.
axiom-implement-iap
Use when the user wants to add in-app purchases, implement StoreKit 2, or set up subscriptions.
asc-revenuecat-catalog-sync
Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across ASC and RevenueCat.
google-play
Google Play Developer API (Android Publisher) integration with managed OAuth. Manage apps, subscriptions, in-app purchases, and reviews. Use this skill when users want to interact with Google Play Console programmatically. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
gplay-iap-setup
In-app products, subscriptions, base plans, and offers setup for Google Play monetization, including bulk-localizing subscription display names, descriptions, and benefits across all locales. Use when configuring in-app purchases or subscription products.
rc-revenuecat-api-quick-reference
Use this skill as a quick reference for the RevenueCat Android SDK 10.x and REST API. Covers SDK init, common Purchases calls, CustomerInfo / Offerings access patterns, and the most used REST endpoints.