model-selector
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
subprocess.runandsubprocess.Popenacross several scripts (catalogue.py, grade.py, invoke.py, selection.py) to interact with agent harness CLIs such as Claude Code, Codex, and OpenCode, as well as to execute local management scripts. - [PERSISTENCE]: The skill includes functionality in capture.py and catalogue.py to install a daily background task (
com.kntnt.model-selector.refresh) vialaunchctlon macOS. This task is designed to automate daily updates of the model catalogue and pricing information. - [EXTERNAL_DOWNLOADS]: The catalogue update mechanism in catalogue.py fetches model metadata and pricing information from the OpenRouter API (
openrouter.ai). OpenRouter is a recognized aggregator service for Large Language Models. - [INDIRECT_PROMPT_INJECTION]: The skill implements an automated grading feature that creates a potential surface for indirect prompt injection.
- Ingestion points: Transcripts and session records are read from harness directories by capture.py and excerpts are extracted for processing.
- Boundary markers: The prompt construction logic in grade.py (the
prompt_forfunction) uses basic text labels to separate sections but lacks robust delimiters or explicit instructions for the judge model to ignore embedded instructions within the ingested content. - Capability inventory: The skill can execute shell commands through model bridge adapters defined in launch.py.
- Sanitization: transcript excerpts are truncated to fixed lengths, but the skill does not perform further escaping or sanitization of the content before inclusion in prompts.
- [DYNAMIC_EXECUTION]: The skill uses
importlib.utilto dynamically load internal sibling modules from the localscripts/directory to manage its modular internal logic.
Audit Metadata