Use this skill when hardening a RevenueCat integration on Android. Covers Trusted Entitlements response verification (INFORMATIONAL vs ENFORCED), why the server is always the authority, API key hygiene (public SDK key vs secret REST key), anonymous user identity, and purchase token protections RevenueCat provides automatically.
Install
npx skills add RevenueCat/ai-toolkit --skill rc-securitynpx skills add RevenueCat/ai-toolkit --skill rc-security -a claude-code -gnpx skills add RevenueCat/ai-toolkit --skill rc-security -a codex -ggemini skills install https://github.com/RevenueCat/ai-toolkit.git --path revenuecat-play-billing/skills/rc-securitygh skill install RevenueCat/ai-toolkit rc-securitygit clone --depth 1 https://github.com/RevenueCat/ai-toolkit /tmp/RevenueCat__ai-toolkit
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/RevenueCat__ai-toolkit/revenuecat-play-billing/skills/rc-security ~/.claude/skills/rc-security # Claude Code
cp -R /tmp/RevenueCat__ai-toolkit/revenuecat-play-billing/skills/rc-security ~/.agents/skills/rc-security # Codex, Cursor, Gemini CLI, Copilot, OpenCode