llm-cli
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Python 'subprocess' module in 'executor.py' to run the 'llm' CLI tool. Arguments are passed as a list and 'shell=True' is not used, which effectively mitigates the risk of command injection from manipulated model names or prompts.\n- [EXTERNAL_DOWNLOADS]: The skill depends on standard, well-known Python packages like 'llm', 'PyPDF2', and 'rich', as listed in 'requirements.txt'. These dependencies are required for core functionality and are sourced from official registries.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from user-provided files or standard input to be processed by an LLM, representing a standard attack surface for indirect prompt injection.\n
- Ingestion points: Data is loaded via 'input_handler.py' from the local filesystem or stdin.\n
- Boundary markers: The skill passes the raw content directly to the 'llm' tool without using XML tags or other boundary markers.\n
- Capability inventory: The skill's primary capability is limited to invoking the 'llm' utility for text generation.\n
- Sanitization: No content sanitization is performed, which is consistent with the skill's purpose of relaying raw information to an LLM provider.
Audit Metadata