stay-within-limits
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the agent to fetch the ccusage package from the npm registry using npx.
- [REMOTE_CODE_EXECUTION]: The use of npx -y ccusage@latest allows for the execution of remote code from a public registry without any version pinning or integrity verification, posing a supply chain risk.
- [COMMAND_EXECUTION]: The agent is instructed to execute shell commands (npx, ccusage) to monitor usage blocks and manage subagents.
- [PROMPT_INJECTION]: The skill ingests data from external tools to manage long-running tasks and construct future instructions, which creates a surface for indirect prompt injection. \n
- Ingestion points: JSON output from the ccusage command (SKILL.md). \n
- Boundary markers: Not present; the instructions do not include delimiters or safety warnings for the interpolated usage data. \n
- Capability inventory: Shell command execution (npx) and orchestration of parallel subagents (SKILL.md). \n
- Sanitization: Not present; there are no instructions to validate or sanitize the tool's output before processing.
Recommendations
- AI detected serious security threats
Audit Metadata