traktoken-query
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to an external domain to fetch pricing data.
- Evidence: curl commands in SKILL.md targeting https://www.traktoken.com/api/prices.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to interact with the TrakToken service.
- Evidence: curl -sS --get --data-urlencode "q=MODEL_NAME" https://www.traktoken.com/api/prices in SKILL.md.
- [PROMPT_INJECTION]: The skill ingests data from an external API, which creates a surface for potential indirect prompt injection.
- Ingestion points: JSON responses from https://www.traktoken.com/api/prices as defined in SKILL.md.
- Boundary markers: Absent. The instructions do not specify the use of delimiters for the ingested data.
- Capability inventory: The skill uses curl to fetch data and performs mathematical calculations on the results.
- Sanitization: No explicit validation or sanitization of the text content within the API response is specified.
Audit Metadata