arkcli-billing

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the arkcli command-line utility (a vendor tool) to perform authentication checks via whoami and retrieve billing data using billing list. It also suggests using jq for JSON data processing.
  • [DYNAMIC_EXECUTION]: The documentation provides bash script templates in the references/arkcli-billing-list.md file for performing client-side pagination and data aggregation. These are standard implementation patterns for CLI-based agents.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external billing data (items, summaries, and error messages) from the arkcli output. While this represents a potential attack surface for indirect injection, the skill includes explicit instructions for the agent to validate inputs (e.g., date formats for --start) and handle truncation warnings (is_truncated) before processing items, which serves as a safety boundary.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 12:10 PM