metronome-setup-catalog
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts exclusively with the official Metronome API domain (
api.metronome.com) and references official documentation (docs.metronome.com), which are verified vendor resources. - [SAFE]: The implementation of authentication through the
$METRONOME_API_TOKENenvironment variable ensures that sensitive credentials are not hardcoded or exposed in the skill's source or logs. - [SAFE]: The skill includes a mandatory 'Confirmation gate' in
references/billable-metrics.md, which requires the agent to present a summary of the proposed configuration and wait for user approval before initiating any API write operations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided pricing descriptions (
<pricing_description>) to automate the creation of billing objects. While this represents a surface for untrusted data ingestion, the risk is effectively mitigated by the skill's requirement for human oversight and verification before execution.
Audit Metadata