skills/jeremylongshore/tons-of-skills-marketplace/coreweave-gpu-cost-leak-hunter/Gen Agent Trust Hub
coreweave-gpu-cost-leak-hunter
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses environment-provided credentials ($CW_TOKEN, $KUBECONFIG) to interact with official CoreWeave APIs and cluster endpoints, which is consistent with its stated purpose of cost auditing.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external command outputs (curl/PromQL results and kubectl node/pod status).\n
- Ingestion points: Data is retrieved from the Grafana Prometheus proxy and Kubernetes API as specified in SKILL.md and categories definitions.\n
- Boundary markers: The skill relies on structured JSON output from PromQL and utilizes a dedicated Python script for parsing and arithmetic rather than direct prompt interpolation of raw API strings.\n
- Capability inventory: The skill utilizes
curl,kubectl get, and a local Python script for data processing and report generation.\n - Sanitization: Input data is parsed using
json.loads()and strictly coerced into numeric types (float/int) withinscripts/rank-and-report.pybefore being formatted into the final CFO-level report template.
Audit Metadata