cost-optimize
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Node.js script
plugins/ruflo-cost-tracker/scripts/outcome.mjsto automate model routing feedback based on cost analysis. - [EXTERNAL_DOWNLOADS]: The documentation provides manual CLI alternatives using
npx @claude-flow/cli@latest, which involves fetching the platform's CLI tool from the npm registry at runtime. - [PROMPT_INJECTION]: An indirect prompt injection surface exists where token usage logs (which may contain user-provided task descriptions) are used as arguments for shell commands.
- Ingestion points: External usage data retrieved via
mcp__claude-flow__memory_searchinSKILL.md. - Boundary markers: No specific delimiters are defined to isolate data from instructions during the usage analysis phase.
- Capability inventory: Shell access is provided via the
Bashtool to run optimization outcomes. - Sanitization: The script
outcome.mjsreportedly usesspawnSyncwith explicit argument passing to ensure shell safety when processing task descriptions.
Audit Metadata