metronome-create-customer
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with the official Metronome API endpoints (api.metronome.com), which matches the author's verified context. It does not perform any unexpected network operations or file system access.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets were detected. The skill correctly references the
$METRONOME_API_TOKENenvironment variable for authentication, which is a secure method for managing API keys. - [PROMPT_INJECTION]: The skill implements a 'Preview then confirm' workflow (Step 3). This human-in-the-loop requirement mitigates risks associated with indirect prompt injection or accidental data entry by ensuring the user reviews the payload before the record is created.
- [COMMAND_EXECUTION]: The skill does not execute shell commands or run external scripts. Its functionality is restricted to standard HTTP interactions with a trusted service.
Audit Metadata