jev-skill-select
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits user requests (referred to as "turns") to a remote API ("Jev") to determine which other skills should be loaded. Although the description states that turns are redacted to remove secrets and that sensitive turns are not sent, the transmission of user-generated content to a non-whitelisted external service remains a security and privacy consideration.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to interpret user input to route the agent to other skills. This creates an attack surface where maliciously crafted input could potentially manipulate the selection logic or lead the agent to load unintended skills.
- Ingestion points: User input is received via the
jev pick-skill --turncommand line argument or intercepted by thehermes-jevplugin during active sessions. - Boundary markers: The skill utilizes a "local gate" to handle simple responses locally and claims to redact secrets from turns before they are sent to the external ranking service.
- Capability inventory: The skill involves network communication with the Jev API, file system read access for skill metadata (SKILL.md front matter), and file system write access to update a feedback log (jev/skill-feedback.json).
- Sanitization: The skill description specifies that input is redacted for secrets before transmission and that emoji or punctuation-only turns are filtered out locally.
Audit Metadata