ai-billing
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of official Node.js packages from the vendor (
@commet/node,@commet/ai-sdk) and trusted third-party organizations (ai,@ai-sdk/anthropic,@ai-sdk/openai). These dependencies are consistent with the skill's purpose of integrating billing for AI models. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by recommending the use of environment variables (
COMMET_API_KEY) for API authentication. Example keys provided in the documentation are generic placeholders (ck_xxxxxxxxx). - [INDIRECT_PROMPT_INJECTION]: The
tracked()middleware processes metadata (token counts) from AI provider responses. This is an ingestion of external data; however, it is used exclusively for billing telemetry and does not influence the agent's behavior or prompt context, posing no risk to the execution environment.
Audit Metadata