k2f-invoice
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input such as client details and line items to generate invoices. * Ingestion points: User-provided text in the workflow. * Boundary markers: The blueprint file acts as an intermediary. * Capability inventory: Shell execution via npx and file system writes. * Sanitization: Instructions include a checklist to verify data and avoid fabrication.
- [EXTERNAL_DOWNLOADS]: The skill requires installing the suzheng/k2f engine using npx. This resource belongs to the skill author.
- [COMMAND_EXECUTION]: The workflow involves shell-based commands like npx to manage dependencies and export files.
Audit Metadata