emergency-fund

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user financial details and risk factors to populate command-line arguments for a local execution script. Ingestion points: User-provided values for essential monthly spend, current savings, and risk profile flags as defined in SKILL.md. Boundary markers: None explicitly present in the skill instructions to separate user data from command context. Capability inventory: Executes the local file scripts/emergency_fund.py using shell command interpolation. The script itself is restricted to standard Python libraries (argparse, json, sys) and does not perform network operations or file writes. Sanitization: The calculation script performs basic type validation (floats and booleans) via the argparse library, which helps prevent malformed input but does not mitigate all prompt injection vectors.
  • [COMMAND_EXECUTION]: The primary functionality of the skill relies on executing a bundled Python script. This script is contained within the skill package and does not require administrative privileges or access to sensitive system resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 02:57 AM