purchasely-cli
Use when the developer mentions the purchasely CLI, or when an integration needs real Console data: list my placements, products, plans, campaigns, custom events or applications, fetch the Console configuration of an app before writing SDK code, or show the key metrics of an app (MRR, active subs...
Install this skill
or
35/100
Security score
The purchasely-cli skill was audited on Oct 23, 2026 and we found 3 security issues across 3 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
critical line 13
Piping content to sh shell
SourceSKILL.md
| 11 | |
| 12 | 1. Check that the CLI exists: `purchasely --version`. It needs Node 20 or later. |
| 13 | 2. If it is missing, ask the developer to install it: `curl -fsSL https://cli.purchasely.io/install.sh | sh`. Do not run an install script without their approval. |
| 14 | 3. The developer signs in once with `purchasely auth login`. The key goes at the prompt, or in the `PURCHASELY_API_KEY` environment variable. Check with `purchasely auth status`. |
| 15 | 4. To set up this plugin for a coding agent, the developer runs `purchasely ai install`. |
high line 13
Curl to non-GitHub URL
SourceSKILL.md
| 11 | |
| 12 | 1. Check that the CLI exists: `purchasely --version`. It needs Node 20 or later. |
| 13 | 2. If it is missing, ask the developer to install it: `curl -fsSL https://cli.purchasely.io/install.sh | sh`. Do not run an install script without their approval. |
| 14 | 3. The developer signs in once with `purchasely auth login`. The key goes at the prompt, or in the `PURCHASELY_API_KEY` environment variable. Check with `purchasely auth status`. |
| 15 | 4. To set up this plugin for a coding agent, the developer runs `purchasely ai install`. |
critical line 13
Curl pipe to interpreter
SourceSKILL.md
| 11 | |
| 12 | 1. Check that the CLI exists: `purchasely --version`. It needs Node 20 or later. |
| 13 | 2. If it is missing, ask the developer to install it: `curl -fsSL https://cli.purchasely.io/install.sh | sh`. Do not run an install script without their approval. |
| 14 | 3. The developer signs in once with `purchasely auth login`. The key goes at the prompt, or in the `PURCHASELY_API_KEY` environment variable. Check with `purchasely auth status`. |
| 15 | 4. To set up this plugin for a coding agent, the developer runs `purchasely ai install`. |
Scanned on Oct 23, 2026
View Security DashboardGitHub Stars 2
Rate this skill
Categorydevelopment
UpdatedNovember 11, 2026
Purchasely/Purchasely-AI-Plugin