transfer-partners
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes flight award availability and pricing data from external sources such as seats.aero.
- Ingestion points: Runtime data for award seats, including source program names and mile costs, are ingested for comparison and calculation (SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat data from external search results as untrusted or to ignore embedded instructions.
- Capability inventory: The skill utilizes shell commands via
jqto process local JSON data and produces markdown tables for the user. It does not have access to file-writing or network-exfiltration tools in the provided instructions. - Sanitization: No specific sanitization or validation steps are outlined for the external award data before it is processed by the logic defined in the workflow.
- [COMMAND_EXECUTION]: The skill contains several
bashcode blocks that use thejqcommand-line utility to query and perform calculations on local data files (e.g.,data/transfer-partners.json). These are provided as functional recipes for the agent to follow during its workflow.
Audit Metadata