money-init
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash command (
test -f) to check for the existence of a local state file (.money-state.json). This is a benign operation used to manage the onboarding flow. - [PROMPT_INJECTION]: The skill collects untrusted user input via six profiling questions (skills, availability, capital, location, etc.). This data is saved to a local JSON file. While the skill doesn't specify sanitization, the data is stored as structured text in a template rather than being used for immediate instruction execution.
Audit Metadata