skills/affaan-m/ecc/ito-compute/Gen Agent Trust Hub

ito-compute

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary functionality is delivered through shell command execution using the ecc utility. It manages GPU inventory queries, RFQ submissions, and authentication tasks.
  • [EXTERNAL_DOWNLOADS]: Users are instructed to clone the canonical source code from github.com/Ito-Markets/ito-cloud-runtime.git and build the CLI locally using npm. This avoids the use of unverified third-party packages.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources when checking GPU inventory and RFQ statuses.
  • Ingestion points: Untrusted data enters via ecc ito find and ecc ito status outputs.
  • Boundary markers: The instructions mandate human verification for financial decisions and describe quotes as indicative.
  • Capability inventory: Subprocess execution is restricted to the specific built CLI tool.
  • Sanitization: Explicit buyer approval is required for quotes, providing a manual check on external data.
  • [SAFE]: The skill follows security best practices by explicitly prohibiting API keys in chat or logs, leveraging the macOS Keychain for token persistence, and requiring restrictive file permissions for local credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 03:11 AM