update-cli-models
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches model pricing and identifier data from official documentation sources, including GitHub's documentation API, Google AI's pricing page, Anthropic's platform overview, and OpenAI's pricing page. These sources are well-known technology service providers and the data fetched is limited to publicly available pricing information.
- [COMMAND_EXECUTION]: Executes a local synchronization script
plugins/cli-agents/scripts/sync_cheapest_models.pyto propagate updated pricing information across the repository. This is an expected operation for a skill managing configuration files. - [DATA_EXPOSURE]: The skill performs read and write operations on local JSON and Markdown files within the skill's reference directory. This access is restricted to the specific files needed for the model catalog and does not target sensitive user credentials or system files.
- [PROMPT_INJECTION]: The skill processes external content from documentation websites to extract pricing metrics. While this represents a theoretical ingestion surface for indirect prompt injection, the skill's instructions focus on structured data extraction into specific JSON fields, which limits the risk of the agent following embedded instructions.
Audit Metadata