estimate-temps-savings
Warn
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to search for and access sensitive environment variable files (e.g.,
.env,.env.example). It specifically targets high-value authentication tokens such asVERCEL_TOKEN,NETLIFY_AUTH_TOKEN,RAILWAY_TOKEN, andFLY_API_TOKENto identify the services in use. Although the instructions include a directive to ignore secret values, accessing these files is a high-risk activity.\n- [COMMAND_EXECUTION]: The skill includes suggested shell commands for the user to install additional skills from an external repository (npx skills add gotempsh/temps --skill ...).\n- [PROMPT_INJECTION]: The skill processes untrusted project data, creating a surface for indirect prompt injection.\n - Ingestion points: Project manifests (
package.json,requirements.txt), configuration files, and environment variable files.\n - Boundary markers: The skill provides instructional "Ground Rules" to delimit what information should be processed, specifically directing the agent to ignore secret values.\n
- Capability inventory: File reading, string processing, and report generation.\n
- Sanitization: The instructions suggest using
cutto isolate environment variable keys from their values during processing.
Audit Metadata