pick-model
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the
$ARGUMENTSvariable to provide model recommendations, which creates a surface for indirect prompt injection.\n - Ingestion points: User-provided task descriptions are parsed from
$ARGUMENTSinSKILL.md.\n - Boundary markers: Instructions lack delimiters (e.g., XML tags or triple quotes) or 'ignore' instructions for the interpolated user data.\n
- Capability inventory: The skill has no dangerous capabilities; it only outputs text recommendations and does not interact with the file system, network, or external processes.\n
- Sanitization: No input validation or sanitization logic is implemented for the task description input.\n- [NO_CODE]: The skill package is composed entirely of Markdown instructions, documentation, and JSON configuration files. It does not include executable scripts, binaries, or library dependencies.
Audit Metadata