claudex-route
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project context, code changes, and user instructions to generate task briefs for other models.
- Ingestion points: The agent reads project context, conversation history, and file contents as described in
SKILL.md. - Boundary markers: Instructions mandate the creation of "self-contained briefs" and "bounded assignments," although they do not enforce specific character-based delimiters.
- Capability inventory: The skill utilizes subprocess execution for model CLIs, file system read access, and temporary file creation.
- Sanitization: The instructions include an explicit security requirement to "never interpolate arbitrary prompts into shell commands," directing the agent to use stdin or safely handled files instead to prevent command injection.
- [COMMAND_EXECUTION]: The skill directs the agent to execute external model CLI tools (such as Claude Code or Codex binaries) to perform delegated tasks. Security controls are explicitly recommended, including the use of isolated worktrees, fresh sessions, unique temporary directories for artifacts, and strict adherence to the host's existing user permissions.
- [EXTERNAL_DOWNLOADS]: The instructions reference official documentation and pricing information from OpenAI (e.g.,
developers.openai.com,learn.chatgpt.com) and Anthropic (e.g.,platform.claude.com,code.claude.com) to guide model selection and non-interactive usage.
Audit Metadata