checkout-abandonment
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill preamble executes several local shell scripts (
rmbc-update-check,rmbc-analytics) to handle version checking and usage logging. These scripts are invoked from the skill's installation directory. - [DATA_EXFILTRATION]: The skill includes an analytics logging component (
rmbc-analytics) used to track usage data. It explicitly prompts the user for consent through theAskUserQuestiontool before enabling telemetry and provides a way to opt-out. - [EXTERNAL_DOWNLOADS]: The skill uses the
opencommand to navigate to an external YouTube URL for instructional content, which only occurs after user confirmation. - [PROMPT_INJECTION]: The skill processes untrusted user input in the
checkout_descriptionfield. However, the execution protocol enforces a structured evidence mapping phase that acts as a natural boundary against accidental instruction following from within the analyzed content.
Audit Metadata