ccr-run
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill serves as a model router that accepts user-defined tasks and passes them to a sub-agent environment.
- Ingestion points: The skill accepts a 'task' string from the user via the command input.
- Boundary markers: It uses tags to encapsulate the model ID, but there are no explicit delimiters or escaping for the user-supplied task content.
- Capability inventory: The skill spawns sub-agents to perform tasks, potentially allowing user-injected instructions to influence sub-agent behavior.
- Sanitization: No input sanitization or validation of the user task is documented before interpolation into the sub-agent prompt.
- [EXTERNAL_DOWNLOADS]: The skill documentation references an external GitHub repository required for the tool to function.
- Evidence: The skill points to a GitHub repository for the 'claude-code-router' tool which is owned by the author 'npow'.
Audit Metadata