Multi-AI Consultant
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions define slash commands that execute external CLI tools (gemini, codex) using the Bash tool. Specifically, the /consult-codex command is configured to use the --yolo flag, which bypasses manual confirmation for command execution.
- [EXTERNAL_DOWNLOADS]: The skill directs users to install external Node.js packages (@google/generative-ai-cli, codex) from the public NPM registry to enable its core functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests untrusted data from external AI responses and local repository context, then processes this information to influence the agent's actions. 1. Ingestion points: User questions, file context provided via @path syntax, and responses received from external AI CLIs (specifically within SKILL.md and README.md). 2. Boundary markers: The skill mandates a specific '5-Part Synthesis Format' to help the agent differentiate its own analysis from external input. 3. Capability inventory: Access to Bash (for CLI execution), Read (file access), Task (subagent creation), and Write (file modification) as specified in the allowed-tools frontmatter. 4. Sanitization: No explicit automated sanitization of external AI responses is mentioned, relying instead on the structural synthesis format.
Audit Metadata