orca-cloud-cost-optimizer
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides example CLI commands for remediation (e.g.,
aws ec2 modify-volume). These are presented as instructional documentation for the user to implement manually, rather than as scripts intended for automatic execution by the agent. - [REMOTE_CODE_EXECUTION]: The skill uses web search to find current cloud pricing information from official provider domains (aws.amazon.com, cloud.google.com, azure.microsoft.com). This is a safe use of external data to ensure accurate financial reporting.
- [PRIVILEGE_ESCALATION]: No privilege escalation patterns detected. The skill operates within the scope of the provided Orca MCP tools to read asset configuration metadata.
- [DATA_EXFILTRATION]: No data exfiltration patterns detected. The skill processes metadata to generate a report within the user's session.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface by ingesting cloud asset metadata (e.g., instance names and tags) which could theoretically contain malicious instructions. However, the skill treats this data as configuration parameters for structured reporting and does not execute them as instructions. The risk is assessed as low given the restricted nature of the asset metadata.
Audit Metadata