model-selector
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill installs a persistent background agent on macOS using
launchctl. Specifically, it creates alaunchdplist file (com.kntnt.model-selector.refresh.plist) in the user'sLaunchAgentsdirectory to run a daily catalogue update job. - Evidence:
scripts/capture.pycontains logic to install and remove the refresh schedule usinglaunchdconstants and labels. - [DYNAMIC_EXECUTION]: The skill employs multiple dynamic execution techniques to load logic and manage tool invocation.
- It uses
importlib.utilto load internal "Library" and sibling scripts from file paths computed at runtime. scripts/invoke.pyimplements a search algorithm that iterates through dozens of hidden tool-specific directories (e.g.,~/.claude/skills,~/.codex/skills) to find and execute a management engine script (kntnt.py) viauv run.- [INDIRECT_PROMPT_INJECTION]: The skill processes recorded unit-of-work data, which includes excerpts of previous instructions and results, to generate prompts for a "judge" model that evaluates performance.
- Ingestion points: Transcripts are read from paths like
~/.claude/projects/and~/.codex/sessions/inscripts/capture.pyandscripts/quota.py. - Boundary markers: Present. In
scripts/grade.py, theprompt_forfunction uses Markdown-style headers ("Instruction:", "Result:") to delimit processed content. - Capability inventory: The skill uses
subprocess.runandsubprocess.Popeninscripts/grade.pyandscripts/selection.pyto execute commands and dispatch tasks. - Sanitization: Partial. Excerpts of instructions and results are capped at 4,000 and 12,000 characters respectively in
scripts/capture.py. - [COMMAND_EXECUTION]: The skill frequently uses the
subprocessmodule to interact with local CLI tools and manage its own lifecycle. scripts/catalogue.pyusessubprocess.Popenwithstart_new_session=Trueto communicate with theclaudeandcodexCLIs for model discovery.scripts/grade.pyusessubprocess.runto call theselection.pyengine andsubprocess.Popento dispatch grading tasks in a new session.- [EXTERNAL_DOWNLOADS]: The skill communicates with external services to keep its model catalogue current.
scripts/catalogue.pyperforms unauthenticated HTTPS GET requests to the OpenRouter API (openrouter.ai/api/v1/models) to retrieve pricing and metadata updates.
Audit Metadata