castai-cost-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to interact with the CAST AI API. These commands are used to retrieve savings data, update cluster policies, and manage hibernation schedules. - [EXTERNAL_DOWNLOADS]: Fetches configuration and status data from
api.cast.ai. This is a well-known service endpoint associated with the CAST AI platform, and the interaction is necessary for the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes data returned from
api.cast.aivia shell commands inSKILL.md. - Boundary markers: None explicitly present in the data ingestion step.
- Capability inventory: The skill is allowed to use Bash, Write, and Edit tools.
- Sanitization: The skill uses
jqto filter API responses, ensuring only specific numeric and string fields (likemonthlySavingsorwastedCpu) are processed, which significantly mitigates the risk of ingesting malicious instructions from the external source.
Audit Metadata