cip-transfer-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill performs its logic locally as described in the documentation.
- [DATA_EXPOSURE]: The skill reads financial data from files provided by the user via command-line arguments. The underlying engine contains no network-capable code (no use of
http,fetch, ortlsmodules) and does not exfiltrate any of the processed data. - [COMMAND_EXECUTION]: The skill runs via a Node.js wrapper that performs file I/O and arithmetic calculations. It does not use unsafe execution functions like
eval()orchild_process.exec()with unvalidated input. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted table data for verification. The analysis shows that this data is processed by a deterministic JavaScript engine rather than being interpolated into LLM prompts for reasoning, effectively neutralizing the risk of injection from input data.
Audit Metadata