offer-urgency-name-price
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages a bundled Python script (
scripts/price_math.py) to perform calculations for the cost of waiting, payment plans, and value ratios. The instructions guide the agent to execute this script using subcommands likewait,plan, andvaluewith user-provided arguments. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from users (buyers and owners), such as pricing, hours lost, and business specifics, which are then interpolated into output templates.
- Ingestion points: User inputs regarding problem costs, hourly rates, and offer prices are collected and processed in
SKILL.mdandreferences/pricing-math.md. - Boundary markers: The skill uses delimiters like square brackets (e.g.,
[hours lost],[N]) as placeholders for missing data and requires labelling sums as estimates to manage output clarity. - Capability inventory: The skill environment includes the ability to execute the provided local Python script. It does not perform network operations or persistent file system modifications.
- Sanitization: The calculation script provides basic input validation by enforcing numeric types (
floatandint) for command-line arguments, which mitigates simple injection into the calculation logic.
Audit Metadata