llm-models

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-supplied prompts and pass them to external Large Language Models.
  • Ingestion points: User input is provided via the --input flag in commands like belt app run within SKILL.md.
  • Boundary markers: Data is structured using JSON objects (e.g., {"prompt": "..."}).
  • Capability inventory: The skill utilizes the Bash tool to execute CLI commands and interact with network-based LLM providers.
  • Sanitization: The skill relies on the target LLM providers (e.g., Anthropic, Google) and the OpenRouter gateway for content safety filtering.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool restricted to the belt command to interact with the inference.sh platform.
  • Evidence: The frontmatter contains allowed-tools: Bash(belt *), and the body provides examples for belt login, belt app run, and belt app search.
  • [EXTERNAL_DOWNLOADS]: The skill provides documentation links to external resources for setting up the necessary CLI environment.
  • Evidence: References https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md for installation instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 11:00 PM
Security Audit — agent-trust-hub — llm-models