cogs-tracking-allocation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill instructions and provided code snippets follow industry standard practices for inventory management and accounting.
- [INDIRECT_PROMPT_INJECTION]: The skill logic processes external data related to orders, shipments, and inventory variants, which constitutes a standard attack surface for indirect prompt injection.
- Ingestion points: Data enters via parameters like
variantId,orderId,shipmentId, andquantityin the TypeScript logic and SQL schema definitions. - Boundary markers: Explicit boundary markers for untrusted data are not present in the code snippets.
- Capability inventory: The skill uses database read/write operations (e.g.,
update,create,findAll) to manage inventory layers and COGS entries. - Sanitization: While not explicitly detailed, the logic uses standard ORM-style methods which typically incorporate parameterization.
- [EXTERNAL_DOWNLOADS]: The skill recommends several well-known third-party applications and services for e-commerce integration, such as Matrixify, QuickBooks, Xero, and Metorik. These are trusted industry standard tools and do not involve untrusted remote code execution or suspicious download behaviors.
Audit Metadata