axiom-audit-iap
Axiom Audit IAP systematically scans Swift codebases to uncover in-app purchase vulnerabilities—from unfinished transactions and missing verification checks to incomplete subscription state handling. The agent maps your StoreKit architecture, identifies 13+ known anti-patterns that trigger rejections or silent revenue leaks, and surfaces missing restore flows, loot box odds disclosure, and server-side validation gaps that leave your app vulnerable to fraud and guideline violations.
Axiom Audit IAP detects in-app purchase anti-patterns and missing implementations that cause revenue loss and App Store rejections.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
Axiom Audit IAP detects in-app purchase anti-patterns and missing implementations that cause revenue loss and App Store rejections. Axiom Audit IAP systematically scans Swift codebases to uncover in-app purchase vulnerabilities—from unfinished transactions and missing verification checks to incomplete subscription state handling. The agent maps your StoreKit architecture, identifies 13+ known anti-patterns that trigger rejections or silent revenue leaks, and surfaces missing restore flows, loot box odds disclosure, and server-side validation gaps that leave your app vulnerable to fraud and guideline violations.
Use it when
- Axiom Audit IAP audits StoreKit transaction handling by examining your transaction listeners, finish() call patterns.
- Axiom Audit IAP detects 13+ anti-patterns including missing promoted purchases handlers.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Similar skills
Install
CharlesWiltgen/Axiom/axiom-audit-iap · repository language: Go
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does axiom-audit-iap detect in in-app purchase audit swift codebases?
Axiom Audit IAP systematically scans Swift codebases to uncover in-app purchase vulnerabilities—from unfinished transactions and missing verification checks to incomplete subscription state handling. The agent maps your StoreKit architecture, identifies 13+ known anti-patterns that trigger rejections or silent revenue leaks, and surfaces missing restore flows, loot box odds disclosure, and server-side validation gaps that leave your app vulnerable to fraud and guideline violations.
How does axiom-audit-iap audit StoreKit transaction handling for verification and completion issues?
Axiom Audit IAP audits StoreKit transaction handling by examining your transaction listeners, finish() call patterns, and verification logic. It detects unfinished transactions that cause revenue loss, missing server-side validation of receipts, and incomplete entitlement granting flows. The tool flags whether you're properly handling transaction state across StoreKit 1 and StoreKit 2 implementations and identifies gaps in error handling that leave purchases in limbo.
What IAP anti-patterns does axiom-audit-iap detect to prevent app store rejection?
Axiom Audit IAP detects 13+ anti-patterns including missing promoted purchases handlers, incomplete subscription disclosure and terms display, loot box odds non-compliance, family sharing entitlement gaps, and restore purchases flow failures. It identifies subscription grace period tracking issues, refund handling for revoked entitlements, and missing app account token server validation—all common rejection triggers and revenue-loss vectors.
Does axiom-audit-iap assess subscription state coverage and IAP architecture completeness?
Yes. Axiom Audit IAP maps your entire IAP architecture to identify subscription state coverage gaps. It evaluates whether your centralized manager pattern handles all subscription lifecycle states, grace periods, and billing retry logic. The tool assesses completeness of state tracking across active, expired, and revoked subscriptions, and flags architectural patterns that leave entitlements inconsistent or unverifiable.
How does axiom-audit-iap evaluate server-side validation and entitlement security?
Axiom Audit IAP examines your server-side receipt validation, app account token handling, and entitlement granting logic. It identifies missing or weak verification checks that expose your backend to fraud, incomplete validation of transaction JWTs in StoreKit 2, and gaps in revoking entitlements when refunds or subscriptions lapse. The tool flags security weaknesses that leave your revenue and user data at risk.
What license does axiom-audit-iap use?
Axiom Audit IAP is released under the MIT license, allowing free use, modification, and distribution with minimal restrictions.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
In-App Purchase Auditor Agent
You are an expert at detecting in-app purchase issues — both known anti-patterns AND missing/incomplete patterns that cause revenue loss, App Store rejections, and customer support problems.
Tool Use Is Mandatory
Run every Glob, Grep, and Read this prompt lists. Do not reason from training data instead of scanning.
- Run each Grep pattern as written; do not collapse them into one mega-regex.
- Run the Read verifications each section calls for.
- "Build a mental model" / "map the architecture" means with tool output in hand, not from memory.
Files to Exclude
Skip: *Tests.swift, *Previews.swift, */Pods/*, */Carthage/*, */.build/*, */DerivedData/*, */scratch/*, */docs/*, */.claude/*, */.claude-plugin/*
Phase 1: Map IAP Architecture
Step 1: Identify StoreKit Version and Entry Points
``
Glob: **/*.swift (excluding test/vendor paths)
Grep for:
-import StoreKit` — StoreKit usage
-
(truncated - see the full file via the links below)
File tree — 2 files
axiom-codex/skills/axiom-audit-iap/SKILL.md
axiom-codex/skills/axiom-audit-iap/agents/openai.yaml
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Detect in-app purchase anti-patterns and missing implementations causing revenue loss”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill walks you through building complete in-app purchase flows with StoreKit 2, starting with configuration files and moving into a centralized StoreManager that handles transactions, verification, and entitlements. You'll learn the testing-first workflow, implement purchase UI, manage subscriptions, and add restore functionality—all while avoiding common pitfalls that lead to App Store rejection.
axiom-payments guides you through integrating real-world payment methods—Apple Pay on native apps and websites, contactless card acceptance via Tap to Pay on iPhone, Wallet passes for tickets and loyalty cards, and post-purchase order tracking. It clarifies when to use Apple Pay versus in-app purchase, covers merchant setup and certificates, and routes you to solutions for payment rejections and sandbox testing.
This skill routes you through comprehensive accessibility diagnostics for iOS, iPadOS, macOS, tvOS, and watchOS apps. Whether you're troubleshooting VoiceOver labels, scaling violations, contrast failures, or preparing for App Store review, it connects you to targeted guidance and automated scanning tools.
This skill helps you troubleshoot Swift Package Manager problems by analyzing Package.swift and Package.resolved files to pinpoint version conflicts, duplicate symbol linker errors, transitive dependency issues, and platform compatibility gaps. It guides you through detection strategies and resolution patterns for common scenarios like version range conflicts, Swift language mode mismatches, and macro target build failures.
Axiom Shipping equips developers with comprehensive guidance for submitting apps to the App Store—from pre-flight checklists and metadata setup to privacy manifest configuration and age rating classification. When rejections occur, the skill provides diagnostic patterns to identify root causes and craft effective appeals. It also covers export compliance, EU DSA requirements, and App Store Connect workflows to ensure smooth releases.
This skill equips Claude with systematic accessibility auditing for iOS apps, scanning for VoiceOver label gaps, Dynamic Type scaling failures, color contrast issues, and gesture-only interactions that block users with disabilities. It runs mandatory tool verification across your codebase to catch anti-patterns and incomplete assistive technology support before App Store submission.
More skills axiom-audit-textkit (MIT) · axiom-audit-testing (MIT) · axiom-audit-swiftdata (MIT) · axiom-audit-concurrency (MIT)