skills/ruvnet/ruflo/cost-optimize/Gen Agent Trust Hub

cost-optimize

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Node.js script plugins/ruflo-cost-tracker/scripts/outcome.mjs to automate model routing feedback based on cost analysis.
  • [EXTERNAL_DOWNLOADS]: The documentation provides manual CLI alternatives using npx @claude-flow/cli@latest, which involves fetching the platform's CLI tool from the npm registry at runtime.
  • [PROMPT_INJECTION]: An indirect prompt injection surface exists where token usage logs (which may contain user-provided task descriptions) are used as arguments for shell commands.
  • Ingestion points: External usage data retrieved via mcp__claude-flow__memory_search in SKILL.md.
  • Boundary markers: No specific delimiters are defined to isolate data from instructions during the usage analysis phase.
  • Capability inventory: Shell access is provided via the Bash tool to run optimization outcomes.
  • Sanitization: The script outcome.mjs reportedly uses spawnSync with explicit argument passing to ensure shell safety when processing task descriptions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 06:52 PM
Security Audit — agent-trust-hub — cost-optimize