multi-llm-consult

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The consult_llm.py script reads local files via the --prompt-file and --context-file arguments and transmits their contents to external LLM provider endpoints. While this is the tool's intended function, it allows for the transmission of sensitive local data to third-party services. The script also supports a --base-url override, which could allow redirecting data to an arbitrary server.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local files and incorporates it into prompts sent to external LLMs, creating a vulnerability to indirect prompt injection.
  • Ingestion points: scripts/consult_llm.py reads data from --prompt-file, --context-file, and standard input.
  • Boundary markers: The script uses a simple "Context:" header to separate the user prompt from the file content, which does not provide robust isolation.
  • Capability inventory: The script performs network POST requests to external LLM APIs.
  • Sanitization: No programmatic sanitization or escaping of the ingested file content is performed by the script.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 12:41 PM
Security Audit — agent-trust-hub — multi-llm-consult