spend-watch
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata, such as project names, branch labels, and workflow titles, from external platform APIs and interpolates them into its reports and notification bodies.
- Ingestion points: API responses from Neon, Vercel, Railway, and GitHub as defined in SKILL.md.
- Boundary markers: The skill instructions explicitly flag fetched content as untrusted data and advise the agent to render them as plain strings, though no technical delimiters (e.g., XML tags) are enforced.
- Capability inventory: The skill possesses the ability to write to the local filesystem (state files and logs), send external notifications, and perform destructive API operations (deleting branches/artifacts) when the 'arm' flag is set.
- Sanitization: No specific technical sanitization or escaping logic is provided for the interpolated strings.
- [COMMAND_EXECUTION]: When the 'arm:' prefix is provided in the configuration variable, the skill is authorized to perform autonomous write operations on external hosts.
- Evidence: The skill contains instructions for deleting stale artifacts via the GitHub API, patching Neon endpoint configurations, and deleting stale Vercel deployments.
- Mitigation: The skill requires an explicit authorization flag in the input variable and performs a live state re-check immediately before executing any mutation to ensure it is not acting on stale information.
Audit Metadata