sync-model-catalog

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs administrative tasks related to model catalog management. All code is transparent and confined to the repository's data directories.
  • [COMMAND_EXECUTION]: The skill uses bash and node to execute a local script (generate_pi_models.mjs). This is standard behavior for a development tool and is used to automate data transformation.
  • [EXTERNAL_DOWNLOADS]: The skill instructions mention using WebSearch and WebFetch to lookup model pricing and standing. This is part of the curated metadata update job and follows best practices for obtaining current information.
  • [REMOTE_CODE_EXECUTION]: The script uses dynamic import() to load a local JavaScript file (models.generated.js) from the node_modules directory. Since this file is a known dependency of the project (@earendil-works/pi-ai), this is considered safe in this context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 04:31 PM
Security Audit — agent-trust-hub — sync-model-catalog