monaco-payslip-calculator
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The documentation describes a method to load the calculation engine by executing the local file 'scripts/payslip_calculator.py' via 'exec'. This dynamic execution is targeted at a static resource bundled with the skill and is used for initialization.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied salary data which is then processed by the calculation script.\n
- Ingestion points: Workflow parameters for salary and employment type in SKILL.md.\n
- Boundary markers: Absent.\n
- Capability inventory: Bash tool, file read/write, and Python script execution.\n
- Sanitization: Input data is sanitized by type-casting to numerical types (float/Decimal) within the calculation logic, preventing the execution of embedded text-based instructions.
Audit Metadata