revenue-forecasting
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill integrates with the Stripe Model Context Protocol (MCP) using official Stripe documentation links. These references target a well-known service and are documented neutrally.
- [PROMPT_INJECTION]: The skill processes external data from the Stripe API, creating a surface for indirect prompt injection. 1. Ingestion points: Data enters the context via Stripe MCP tool calls (SKILL.md). 2. Boundary markers: The skill includes explicit instructions to use read-only mode for audits and to confirm before performing any write operations (SKILL.md). 3. Capability inventory: The skill is limited to performing mathematical forecasting and generating markdown reports; it contains no subprocess calls, network exfiltration, or file system modifications. 4. Sanitization: While not explicitly sanitized, the data is used for numeric calculations and templated output. The potential impact is low, and the overall behavior is consistent with the stated purpose.
Audit Metadata