llm-model-lifecycle
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where instructions could potentially be embedded in data processed at runtime.
- Ingestion points: The skill reads model configuration and state data from
00_project/llm_model_snapshot.jsonand processes responses from local LLM server endpoints (/models,/api/ps). - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the snapshot JSON format.
- Capability inventory: The skill executes shell commands using
python scripts/llm_model_lifecycle.pyto perform listing, unloading, and restoration operations. - Sanitization: The instructions do not specify validation or sanitization routines for the data retrieved from the snapshot file or external server APIs before processing.
- [COMMAND_EXECUTION]: The skill uses Python scripts (
scripts/llm_model_lifecycle.py) to interact with the system and local LLM servers via shell commands. While these are localized and serve the skill's primary purpose of model management, they represent a capability that interacts directly with the host environment.
Audit Metadata