cost-optimize
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes shell commands using
nodeandnpx. It specifically calls a local script located atplugins/ruflo-cost-tracker/scripts/outcome.mjsand the@claude-flow/cliutility to process model outcomes. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto execute@claude-flow/cli@latest, which involves fetching the package from the npm registry at runtime. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Reads usage and optimization data from the
cost-trackingandcost-patternsnamespaces using thememory_searchtool. - Boundary markers: No explicit delimiters are used for the ingested memory data within the prompt instructions.
- Capability inventory: Includes command execution (
node,npx), file storage via memory tools, and network communication via the model-outcome hook. - Sanitization: The skill instructions explicitly note the use of
spawnSyncwithexplicit-argvin the outcome script to prevent command injection when handling task descriptions as arguments.
Audit Metadata