The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with Metronome's official API endpoints (api.metronome.com and staging.api.metronome.com) to retrieve billing, contract, and usage data. These operations are directed at a well-known service infrastructure associated with the skill's primary purpose.
[CREDENTIALS_UNSAFE]: The skill correctly manages authentication by instructing the agent to use a $METRONOME_API_TOKEN environment variable rather than hardcoding credentials.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. Collected billing data is processed locally within the agent's context to generate reports for the user, and no unauthorized network requests to third-party domains are present.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses (customer names, contract terms). While this constitutes an attack surface, the risk is mitigated as the skill uses this data for structured calculations (variance, thresholds) and reporting rather than executing instructions contained within the data. Boundary markers are effectively maintained through the specific analytical phases defined in the reference files.

metronome-csm-reviews