axiom-audit-iap
Axiom Audit IAP systematically scans Swift codebases to uncover in-app purchase vulnerabilities—from unfinished transactions and missing verification checks to incomplete subscription state handling. The agent maps your StoreKit architecture, identifies 13+ known anti-patterns that trigger rejections or silent revenue leaks, and surfaces missing restore flows, loot box odds disclosure, and server-side validation gaps that leave your app vulnerable to fraud and guideline violations.
Axiom Audit IAP detects in-app purchase anti-patterns and missing implementations that cause revenue loss and App Store rejections.
AI-generated summary based on this skill's SKILL.md
Install
CharlesWiltgen/Axiom/axiom-audit-iap · repository language: Go
git clone https://github.com/CharlesWiltgen/Axiom
cp -r Axiom/axiom-codex/skills/axiom-audit-iap ~/.claude/skills/axiom-audit-iapFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does axiom-audit-iap detect in in-app purchase audit swift codebases?
Axiom Audit IAP systematically scans Swift codebases to uncover in-app purchase vulnerabilities—from unfinished transactions and missing verification checks to incomplete subscription state handling. The agent maps your StoreKit architecture, identifies 13+ known anti-patterns that trigger rejections or silent revenue leaks, and surfaces missing restore flows, loot box odds disclosure, and server-side validation gaps that leave your app vulnerable to fraud and guideline violations.
How does axiom-audit-iap audit StoreKit transaction handling for verification and completion issues?
Axiom Audit IAP audits StoreKit transaction handling by examining your transaction listeners, finish() call patterns, and verification logic. It detects unfinished transactions that cause revenue loss, missing server-side validation of receipts, and incomplete entitlement granting flows. The tool flags whether you're properly handling transaction state across StoreKit 1 and StoreKit 2 implementations and identifies gaps in error handling that leave purchases in limbo.
What IAP anti-patterns does axiom-audit-iap detect to prevent app store rejection?
Axiom Audit IAP detects 13+ anti-patterns including missing promoted purchases handlers, incomplete subscription disclosure and terms display, loot box odds non-compliance, family sharing entitlement gaps, and restore purchases flow failures. It identifies subscription grace period tracking issues, refund handling for revoked entitlements, and missing app account token server validation—all common rejection triggers and revenue-loss vectors.
Does axiom-audit-iap assess subscription state coverage and IAP architecture completeness?
Yes. Axiom Audit IAP maps your entire IAP architecture to identify subscription state coverage gaps. It evaluates whether your centralized manager pattern handles all subscription lifecycle states, grace periods, and billing retry logic. The tool assesses completeness of state tracking across active, expired, and revoked subscriptions, and flags architectural patterns that leave entitlements inconsistent or unverifiable.
How does axiom-audit-iap evaluate server-side validation and entitlement security?
Axiom Audit IAP examines your server-side receipt validation, app account token handling, and entitlement granting logic. It identifies missing or weak verification checks that expose your backend to fraud, incomplete validation of transaction JWTs in StoreKit 2, and gaps in revoking entitlements when refunds or subscriptions lapse. The tool flags security weaknesses that leave your revenue and user data at risk.
What license does axiom-audit-iap use?
Axiom Audit IAP is released under the MIT license, allowing free use, modification, and distribution with minimal restrictions.
SKILL.md
rendered from the published skill — quoted content, verbatim
In-App Purchase Auditor Agent
You are an expert at detecting in-app purchase issues — both known anti-patterns AND missing/incomplete patterns that cause revenue loss, App Store rejections, and customer support problems.
Tool Use Is Mandatory
Run every Glob, Grep, and Read this prompt lists. Do not reason from training data instead of scanning.
- Run each Grep pattern as written; do not collapse them into one mega-regex.
- Run the Read verifications each section calls for.
- "Build a mental model" / "map the architecture" means with tool output in hand, not from memory.
Files to Exclude
Skip: *Tests.swift, *Previews.swift, */Pods/*, */Carthage/*, */.build/*, */DerivedData/*, */scratch/*, */docs/*, */.claude/*, */.claude-plugin/*
Phase 1: Map IAP Architecture
Step 1: Identify StoreKit Version and Entry Points
``
Glob: **/*.swift (excluding test/vendor paths)
Grep for:
-import StoreKit` — StoreKit usage
-
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
axiom-codex/skills/axiom-audit-iap/SKILL.md
axiom-codex/skills/axiom-audit-iap/agents/openai.yaml