Skills
Navigate
skills/nyldn/claude-octopus/skill-cost-projections/Gen Agent Trust Hub

skill-cost-projections

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local JSONL files which could be manipulated to influence agent behavior or outputs.
  • Ingestion points: Reads cost and phase data from ~/.claude-octopus/metrics/session-*.jsonl using jq within shell blocks in SKILL.md.
  • Boundary markers: The skill does not implement specific boundary markers or instructions for the agent to treat the metrics data as untrusted or non-executable content.
  • Capability inventory: The skill uses jq for data extraction and bc for arithmetic operations within a shell environment.
  • Sanitization: The skill relies on structural parsing by jq but lacks specific sanitization or validation of the content within the JSON fields before they are used in projections.
  • [COMMAND_EXECUTION]: The skill executes shell commands including jq, bc, and date to process local files and environment variables for the purpose of calculating workflow estimates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 02:21 PM