skills/kntnt/skills/model-selector/Gen Agent Trust Hub

model-selector

Warn

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: MEDIUMPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The skill installs a persistent background agent on macOS using launchctl. Specifically, it creates a launchd plist file (com.kntnt.model-selector.refresh.plist) in the user's LaunchAgents directory to run a daily catalogue update job.
  • Evidence: scripts/capture.py contains logic to install and remove the refresh schedule using launchd constants and labels.
  • [DYNAMIC_EXECUTION]: The skill employs multiple dynamic execution techniques to load logic and manage tool invocation.
  • It uses importlib.util to load internal "Library" and sibling scripts from file paths computed at runtime.
  • scripts/invoke.py implements a search algorithm that iterates through dozens of hidden tool-specific directories (e.g., ~/.claude/skills, ~/.codex/skills) to find and execute a management engine script (kntnt.py) via uv run.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes recorded unit-of-work data, which includes excerpts of previous instructions and results, to generate prompts for a "judge" model that evaluates performance.
  • Ingestion points: Transcripts are read from paths like ~/.claude/projects/ and ~/.codex/sessions/ in scripts/capture.py and scripts/quota.py.
  • Boundary markers: Present. In scripts/grade.py, the prompt_for function uses Markdown-style headers ("Instruction:", "Result:") to delimit processed content.
  • Capability inventory: The skill uses subprocess.run and subprocess.Popen in scripts/grade.py and scripts/selection.py to execute commands and dispatch tasks.
  • Sanitization: Partial. Excerpts of instructions and results are capped at 4,000 and 12,000 characters respectively in scripts/capture.py.
  • [COMMAND_EXECUTION]: The skill frequently uses the subprocess module to interact with local CLI tools and manage its own lifecycle.
  • scripts/catalogue.py uses subprocess.Popen with start_new_session=True to communicate with the claude and codex CLIs for model discovery.
  • scripts/grade.py uses subprocess.run to call the selection.py engine and subprocess.Popen to dispatch grading tasks in a new session.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with external services to keep its model catalogue current.
  • scripts/catalogue.py performs unauthenticated HTTPS GET requests to the OpenRouter API (openrouter.ai/api/v1/models) to retrieve pricing and metadata updates.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 1, 2026, 09:06 PM