d
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several Python and Bash scripts located in the
$SDIR(scripts directory). These includejev-route.py,print-route-rules.py,get-routing-manifest.sh,jev-intent-align.py,grill-jev.py, andbuild-dispatch.py. These scripts are part of the internal orchestration and are not provided by the user. - [EXTERNAL_DOWNLOADS]: The skill mentions using 'Vercel AI Gateway' and 'TypeSafe' API endpoints for 'Jev' (an external validation service). These are used for intent alignment and attachment classification. The skill documents that sensitive credentials (API keys) are handled via environment variables and never passed as command-line arguments or logged.
- [REMOTE_CODE_EXECUTION]: While the skill dispatches tasks to other agents and skills using
build-dispatch.py, this is the primary intended function of a router and is gated by internal validators and deterministic safety rules (e.g., forcing security work to a specific quality gate). - [DATA_EXFILTRATION]: The router sends user request text and project metadata (language names, framework names) to the Jev gateway for classification. This is documented as part of the tool's design rationale to ensure accurate routing and does not include sensitive files like SSH keys or environment variables.
- [SAFE]: The skill enforces a 'force-route' guard (
pre-route.py) that overrides model-picked routes for sensitive workflows likepr-workflowandsecurity, preventing potential prompt injection from bypassing established safety pipelines.
Audit Metadata