token-save
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill logic depends on data read from an external JSON file, which creates a surface where the agent's behavior (model selection) is controlled by the file content.
- Ingestion points: The agent is instructed to read
~/.claude/token-save-routing.jsonto determine the model routing table (SKILL.md). - Boundary markers: There are no instructions providing delimiters or warnings to ignore potentially malicious instructions embedded within the routing configuration.
- Capability inventory: The skill performs file system read and write operations on configuration files within the user's
~/.claude/directory (SKILL.md). - Sanitization: The instructions do not specify any validation or sanitization for the JSON data before it is processed by the agent.
Audit Metadata