arkcli-billing
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
arkclicommand-line utility (a vendor tool) to perform authentication checks viawhoamiand retrieve billing data usingbilling list. It also suggests usingjqfor JSON data processing. - [DYNAMIC_EXECUTION]: The documentation provides bash script templates in the
references/arkcli-billing-list.mdfile for performing client-side pagination and data aggregation. These are standard implementation patterns for CLI-based agents. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external billing data (items, summaries, and error messages) from the
arkclioutput. While this represents a potential attack surface for indirect injection, the skill includes explicit instructions for the agent to validate inputs (e.g., date formats for--start) and handle truncation warnings (is_truncated) before processing items, which serves as a safety boundary.
Audit Metadata