skills/ruvnet/ruflo/cost-optimize/Gen Agent Trust Hub

cost-optimize

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates and executes shell commands using node and npx. It specifically calls a local script located at plugins/ruflo-cost-tracker/scripts/outcome.mjs and the @claude-flow/cli utility to process model outcomes.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to execute @claude-flow/cli@latest, which involves fetching the package from the npm registry at runtime.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Reads usage and optimization data from the cost-tracking and cost-patterns namespaces using the memory_search tool.
  • Boundary markers: No explicit delimiters are used for the ingested memory data within the prompt instructions.
  • Capability inventory: Includes command execution (node, npx), file storage via memory tools, and network communication via the model-outcome hook.
  • Sanitization: The skill instructions explicitly note the use of spawnSync with explicit-argv in the outcome script to prevent command injection when handling task descriptions as arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:38 AM