welfare-limit-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely locally using standard Node.js libraries to audit financial data, with no detected malicious functionality or security vulnerabilities.
- [DATA_EXFILTRATION]: The audit engine explicitly avoids the use of networking modules such as 'http', 'https', or 'fetch', ensuring that sensitive financial information processed by the skill is not transmitted externally.
- [COMMAND_EXECUTION]: The skill provides a legitimate entry point script ('scripts/run.mjs') for processing financial data files. There is no evidence of arbitrary command execution or shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface but the risk is low.
- Ingestion points: 'scripts/run.mjs' accepts external text input via the '--input' argument.
- Boundary markers: No explicit delimiters or 'ignore' instructions are present in the audit engine logic.
- Capability inventory: The skill is restricted to file reading and console output; it lacks networking, subprocess execution, or file writing capabilities.
- Sanitization: The audit engine normalizes input into numeric and predefined tabular formats, effectively neutralizing embedded instructions.
- [EXTERNAL_DOWNLOADS]: The documentation contains references to official payment services (SkillPay/Alipay) and vendor documentation for purchasing extended features. These references are transparently presented as instructions for the user and are not automatically executed by the skill's code.
Audit Metadata