skills/kntnt/skills/model-selector/Gen Agent Trust Hub

model-selector

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run and subprocess.Popen across several scripts (catalogue.py, grade.py, invoke.py, selection.py) to interact with agent harness CLIs such as Claude Code, Codex, and OpenCode, as well as to execute local management scripts.
  • [PERSISTENCE]: The skill includes functionality in capture.py and catalogue.py to install a daily background task (com.kntnt.model-selector.refresh) via launchctl on macOS. This task is designed to automate daily updates of the model catalogue and pricing information.
  • [EXTERNAL_DOWNLOADS]: The catalogue update mechanism in catalogue.py fetches model metadata and pricing information from the OpenRouter API (openrouter.ai). OpenRouter is a recognized aggregator service for Large Language Models.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements an automated grading feature that creates a potential surface for indirect prompt injection.
  • Ingestion points: Transcripts and session records are read from harness directories by capture.py and excerpts are extracted for processing.
  • Boundary markers: The prompt construction logic in grade.py (the prompt_for function) uses basic text labels to separate sections but lacks robust delimiters or explicit instructions for the judge model to ignore embedded instructions within the ingested content.
  • Capability inventory: The skill can execute shell commands through model bridge adapters defined in launch.py.
  • Sanitization: transcript excerpts are truncated to fixed lengths, but the skill does not perform further escaping or sanitization of the content before inclusion in prompts.
  • [DYNAMIC_EXECUTION]: The skill uses importlib.util to dynamically load internal sibling modules from the local scripts/ directory to manage its modular internal logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 07:35 AM
Security Audit — agent-trust-hub — model-selector