transfer-partners

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes flight award availability and pricing data from external sources such as seats.aero.
  • Ingestion points: Runtime data for award seats, including source program names and mile costs, are ingested for comparison and calculation (SKILL.md).
  • Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat data from external search results as untrusted or to ignore embedded instructions.
  • Capability inventory: The skill utilizes shell commands via jq to process local JSON data and produces markdown tables for the user. It does not have access to file-writing or network-exfiltration tools in the provided instructions.
  • Sanitization: No specific sanitization or validation steps are outlined for the external award data before it is processed by the logic defined in the workflow.
  • [COMMAND_EXECUTION]: The skill contains several bash code blocks that use the jq command-line utility to query and perform calculations on local data files (e.g., data/transfer-partners.json). These are provided as functional recipes for the agent to follow during its workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:57 PM