sync-models

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [Remote Data Retrieval]: The skill uses WebFetch and curl to retrieve model lists from router.huggingface.co. This is the intended source of truth for the model synchronization process and targets the author's own infrastructure.
  • [Local Script Execution]: A Python script is used to perform a set difference between the remote router list and the local configuration files (prod.yaml/dev.yaml). This is a common and efficient pattern for precise configuration management.
  • [Automated Configuration Updates]: The skill instructs the agent to add and remove entries in YAML files based on the retrieved data. It includes specific heuristics for model metadata, such as flagging 'reasoning-capable' models and enabling 'artifacts' for larger models (32B+ parameters). These actions are well-scoped and align with the skill's stated purpose of maintaining the chat-ui environment.
  • [External Research]: The workflow involves researching model specifications and provider documentation (e.g., Groq, Cerebras, Together AI) to ensure accurate metadata. This data is used to inform human-readable descriptions and feature flags.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 05:14 PM
Security Audit — agent-trust-hub — sync-models