AI Agent Cost Optimization Cookbook: Cut Your Agent Bills by 60% Without Sacrificing Quality

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.3.1

Overview

This is a non-executable cost-optimization guide with one unnecessary but disclosed public wallet-address requirement.

Safe to use as a markdown guide. Do not provide private keys, seed phrases, or wallet secrets; even a public wallet address can link activity to your identity. Review and sandbox any Python snippets before applying them to real billing, observability, or production model-routing systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill declares a required WALLET_ADDRESS credential even though the content is a non-executable markdown guide about agent cost optimization and contains no feature that needs payment receipt or blockchain interaction. Requesting unrelated credentials violates least-privilege and can normalize unnecessary secret/identifier collection, creating avoidable exposure and confusion for users integrating the skill.

VirusTotal

66/66 vendors flagged this skill as clean.