pricing-tracker
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate data extraction and normalization of pricing tiers from publicly available SaaS and API vendor pages. It uses standard scraping patterns and focuses on structured output generation.
- [DATA_EXPOSURE_&_EXFILTRATION]: No sensitive data access or unauthorized exfiltration patterns were detected. The network operations are limited to scraping user-provided or vendor-specific pricing URLs, which is consistent with the skill's primary purpose. It also appropriately handles 'sources' and 'capturedAt' metadata for transparency.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external pricing pages. While this presents a surface for indirect prompt injection, the risk is mitigated by instructions to normalize data into a strict JSON schema where numbers must be scalars and text is scoped to specific fields like 'notes' or 'features'. Findings in this category are low risk.
- [COMMAND_EXECUTION]: The skill does not contain any shell commands, subprocess calls, or privilege escalation attempts. Examples provided in the documentation are for API usage patterns (
agent.run) and do not execute arbitrary code.
Audit Metadata