cost-tracking

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Includes a utility script (scripts/verify.sh) intended for local use to lint cost-tracking configuration files. The script is a read-only bash utility that uses standard Unix tools like grep and awk to verify that pricing tables and ledger schemas contain mandatory fields. It does not perform network operations or access sensitive directories.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for ingesting and processing usage data received from external AI provider API responses.
  • Ingestion points: Data enters the system via the usage object in response payloads from model providers (Anthropic, OpenAI).
  • Boundary markers: The skill recommends the use of idempotency keys (request_id) and structured append-only ledgers to maintain data integrity.
  • Capability inventory: The defined workflow includes SQL ledger writes, triggering application alerts, and implementing model downshifting or request refusal logic.
  • Sanitization: The skill advises using versioned, data-loaded pricing tables and implementing 'fail-loud' logic for unknown models to prevent billing errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 03:22 AM