skills/cnife/skills/models-dev-query/Gen Agent Trust Hub

models-dev-query

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches aggregated AI model metadata, including pricing and context limits, from https://models.dev/api.json. This is a well-known community resource.
  • [EXTERNAL_DOWNLOADS]: Retrieves detailed model specifications (TOML files) from the official anomalyco/models.dev repository on GitHub using the GitHub CLI (gh api) and curl. GitHub is a trusted service.
  • [COMMAND_EXECUTION]: Uses local shell commands including curl, jq, gh, sed, xargs, and sort to query, filter, and format model information for presentation to the user.
  • [PROMPT_INJECTION]:
  • Ingestion points: Ingests external model specification data from models.dev and GitHub (SKILL.md).
  • Boundary markers: None explicitly present in the provided instructions; processed content is passed directly to the agent context.
  • Capability inventory: Data retrieval and formatting via curl, gh, and jq. No file system writes or code execution capabilities are present.
  • Sanitization: External data is processed via structured query tools (jq), which mitigates direct code injection but maintains a surface for indirect prompt injection if the source data contains malicious natural language instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 06:24 AM
Security Audit — agent-trust-hub — models-dev-query