plaid-recurring-detection
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates integration with Plaid, which is a well-known and established financial services provider. The workflows and tool calls (
plaid_getRecurring,plaid_syncTransactions, etc.) align with standard financial data processing practices. - [SAFE]: All external references and documentation links point to official Plaid domains (
plaid.com), which are recognized as trusted services for financial API documentation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of transaction descriptions and merchant names from the Plaid API. While this represents a potential injection surface, the skill's primary function is data retrieval and display rather than instruction execution, and it operates within the scope of its intended purpose.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns, unauthorized package installations, or piped shell commands were detected. The TypeScript snippets provided are for illustrative integration purposes.
- [CREDENTIALS_UNSAFE]: The skill uses placeholders (e.g.,
accessToken) for sensitive information in its examples, following best practices for avoiding hardcoded secrets.
Audit Metadata