Skill

trigger-cost-savings

skill:triggerdotdev/trigger.dev#packages/cli-v3/skills/trigger-cost-savings

Analyze Trigger.dev tasks, schedules, and runs for cost optimization opportunities. Use when asked to reduce spend, optimize costs, audit usage, right-size machines, or review task efficiency. Combines static source analysis with live run analysis via the Trigger.dev MCP tools (list_runs, get_run_details, get_current_worker).

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:19 UTC at 5a1c142

findings

high

highest severity

threat classes

7,493

files scanned

11/11

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:packages/cli-v3/skills/trigger-cost-savings:packages/cli-v3/skills/trigger-cost-savings/SKILL.md:14:SUPPLY
suspicious: finding skill:packages/cli-v3/skills/trigger-cost-savings:packages/cli-v3/skills/trigger-cost-savings/SKILL.md:19:EXEC
suspicious: finding skill:packages/cli-v3/skills/trigger-cost-savings:packages/cli-v3/skills/trigger-cost-savings/SKILL.md:19:SUPPLY
suspicious: finding skill:packages/cli-v3/skills/trigger-cost-savings:packages/cli-v3/skills/trigger-cost-savings/SKILL.md:21:SUPPLY

Security findings 4

Supply chain

highContextual riskhigh confidence

The skill defers its entire cost-audit workflow to a SKILL.md and docs under node_modules/@trigger.dev/sdk/, content this artifact does not ship, so the instructions the agent follows at runtime come from whatever the installed dependency provides rather than from the reviewed skill.

packages/cli-v3/skills/trigger-cost-savings/SKILL.md:14

The full, version-pinned cost-audit workflow ships **inside your installed `@trigger.dev/sdk`**.

conceal:remotetrigger:conditionalvector:instruction

Counter-argument considered

The deferral is real: the operative checklist, MCP steps, and cost tables live in dependency-shipped files the artifact does not carry, and the agent is concretely told to read them, which no carve-out covers. The deferral is openly declared in the body (D4-D8), so the undeclared/concealment element fails, but declaration alone does not neutralize the instruction-outsourcing behavior and the finding's description is accurate.

Code execution

highContextual riskmedium confidence

The skill conditionally instructs the agent to auto-install the @trigger.dev/sdk package with no version pinned as a prerequisite when the deferred workflow files are missing, executing an installer whose content is not part of the reviewed artifact.

packages/cli-v3/skills/trigger-cost-savings/SKILL.md:19

If those paths don't exist, `@trigger.dev/sdk` isn't installed yet — install it first.

trigger:conditionalvector:instruction

Counter-argument considered

The conditional install instruction is present and concrete, but it names no version, so the pinned-official-registry-installs carve-out does not apply and the agent would execute an installer outside the reviewed artifact. The install is openly declared (D9), so the undeclared gate fails, yet declaration is not a mitigation and nothing in the text neutralizes the behavior.

Supply chain

highContextual riskmedium confidence

The skill instructs the agent to run npx trigger.dev@latest install-mcp, downloading and executing the trigger.dev package at the mutable @latest tag from the npm registry to install an MCP server as a prerequisite for live run analysis.

packages/cli-v3/skills/trigger-cost-savings/SKILL.md:21-22

Live run analysis needs the Trigger.dev MCP server (`npx trigger.dev@latest install-mcp`).

conceal:remotevector:instruction

Counter-argument considered

The skill hands the agent an executable npx command at the mutable @latest tag, which the pinned-official-registry-installs carve-out explicitly excludes; the fallback (static analysis only, never fabricate run data) makes the step conditional but does not remove the download-and-execute instruction. The command is declared verbatim (D12/D13), so undeclared fails, but the claim about the @latest install is accurate and unneutralized.

Supply chain

mediumContextual riskmedium confidence

The skill conditions on missing files and instructs the agent to run a package installation as an automatic prerequisite before the task, pulling code at an unpinned version from the npm registry.

packages/cli-v3/skills/trigger-cost-savings/SKILL.md:19

If those paths don't exist, `@trigger.dev/sdk` isn't installed yet — install it first.

trigger:conditionalvector:instruction

Counter-argument considered

Same line as the EXEC finding: the skill conditions on missing files and orders an install with no version constraint, pulling whatever the registry currently serves; the carve-out for installs requires a pin, which is absent, and no other carve-out or mitigation covers it. The instruction is declared verbatim (D9), so the undeclared gate fails while the supply-chain claim itself stands.

Open questions 7

What the analysis could not settle from the code alone.

Whether @trigger.dev/sdk referenced by this skill is a first-party workspace package of this repository or an external npm dependency, which determines whether the deferred workflow content is reviewable artifact content.

Only the YAML frontmatter (lines 1-10) of SKILL.md is shown; the body of the skill containing any actual instructions, commands, or scripts is not visible in this batch, so no behavior chain can be confirmed or excluded for this skill.

[invalid file request] This repository file is the counterpart of the canonical spend guidance the agent is told to read at node_modules/@trigger.dev/sdk/docs/how-to-reduce-your-spend.mdx: does it contain only cost-optimization guidance, or any instructions steering the agent beyond the declared task (hijack, exfiltration, credential access, persistence, concealment)?

Agent hijacking

[file request packages/trigger-sdk/skills/trigger-cost-savings/SKILL.md] This repository file matches the deferred runtime path node_modules/@trigger.dev/sdk/skills/trigger-cost-savings/SKILL.md that the agent is told to read as its core workflow: does its instruction content stay within Trigger.dev cost analysis or contain directives beyond the declared task (hijack, exfiltration, credential access, persistence, concealment)?

Agent hijacking

[file request packages/trigger-sdk/docs/how-to-reduce-your-spend.mdx] If the @trigger.dev/sdk package in this repository bundles its own copy of the spend guidance that lands in node_modules at runtime, does that copy contain only cost-optimization guidance, or any instructions steering the agent beyond the declared task?

Agent hijacking

[file request node_modules/@trigger.dev/sdk/skills/trigger-cost-savings/SKILL.md] Does the repository ship this deferred workflow file, and if so does its instruction content stay within Trigger.dev cost analysis or contain directives beyond the declared task (hijack, exfiltration, credential access, persistence, concealment)?

Agent hijacking

[file request node_modules/@trigger.dev/sdk/docs/how-to-reduce-your-spend.mdx] Does this canonical guidance document the agent is told to read contain only cost-optimization guidance, or any instructions steering the agent beyond the declared task?

Agent hijacking

Coverage gaps 30

Parts of the artifact the static analysis could not fully examine.

context:submodule_present submodules are not fetched

.gitmodules

context:unanalyzable_binary binary content is only byte-scanned

apps/webapp/app/runEngine/concerns/queues.server.ts

context:unanalyzable_binary binary content is only byte-scanned

apps/webapp/app/services/realtime/envChangeRouter.server.ts

context:unanalyzable_binary binary content is only byte-scanned

apps/webapp/public/favicon.ico

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/drizzle/SKILL.md

context:frontmatter_unparseable mapping values are not allowed here

.claude/skills/drizzle/SKILL.md

context:frontmatter_unparseable while scanning an alias

.cursor/rules/writing-tasks.mdc

context:manifest_unparseable yaml: YAML aliases are not permitted

hosting/docker/webapp/docker-compose.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

hosting/docker/worker/docker-compose.yml