models-dev-query
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a model catalog from an external URL (https://models.dev/catalog.json) and saves it to a temporary file path (/tmp/models-dev-catalog.json).
- [COMMAND_EXECUTION]: The skill utilizes shell commands including curl for network requests and jq for complex JSON data processing and filtering.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for untrusted external data which is then processed by the agent to fulfill user requests.
- Ingestion points: The agent is instructed to download and read content from https://models.dev/catalog.json within SKILL.md.
- Boundary markers: No explicit boundary markers or instructions to treat the ingested data as untrusted are provided.
- Capability inventory: The skill possesses the ability to perform network downloads (curl), file system operations (write/read in /tmp/), and command-line data processing (jq).
- Sanitization: The skill lacks validation or sanitization mechanisms to ensure the downloaded JSON content does not contain instructions that could manipulate the agent's output.
Recommendations
- HIGH: Downloads and executes remote code from: https://models.dev/catalog.json - DO NOT USE without thorough review
Audit Metadata