tribunal
Warn
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple external AI CLI tools using
subprocess.Popeninbin/detect-runners. It dispatches commands likecodex debug models,agy models, andcursor-agent modelsto discover reachable models. In theSKILL.mdinstructions, it also guides the agent to launch concurrent processes for each (runner, model) pair, potentially triggering a large number of external executions. - [EXTERNAL_DOWNLOADS]: The skill relies on and interacts with various external AI CLI tools (Codex, Claude Code, Gemini CLI, Aider, etc.). Although it does not download these tools directly, it is designed to discover and invoke them if they are present on the host system.
- [DYNAMIC_EXECUTION]: The Python script
bin/detect-runnersuses aThreadPoolExecutorto concurrently map thedetect_runnerfunction across a list of runner specifications. This dynamically probes the system for installed binaries and executes their discovery commands to build a runtime model catalog.
Audit Metadata