pricing-and-packaging
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local Node.js utility (resources/price-packaging.js) to perform pricing calculations. This script is self-contained and uses standard Node.js APIs to process input and display results.
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON-formatted tier data which may come from user-controlled files. This input is then used to generate a report for the agent to present. The risk of prompt injection through the data (e.g., in tier names) is mitigated by the script's lack of privileged capabilities and strict numerical validation of key fields.
- Ingestion points: JSON input provided via file path (--input) or command-line argument in resources/price-packaging.js.
- Boundary markers: Absent.
- Capability inventory: File system read access (via fs.readFileSync), console logging. No network access or file system write access.
- Sanitization: Uses JSON.parse and a validation function (validateTiers) to enforce schemas and data types.
- [SAFE]: Overall, the skill follows secure practices by using a deterministic script with limited scope and no external dependencies.
Audit Metadata