model-roundtable
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several internal Python scripts (e.g.,
run_codex.py,run_gemini.py,run_kimi.py,runner_jobs.py) and CLI utilities (such asagyandkimi-cli) via shell commands to launch and manage model roundtable seats. These executions are part of the core functionality described inreferences/runner-invocations.md. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it interpolates untrusted user content into the instructions for multiple sub-agents.
- Ingestion points: Raw user prompts and context file paths enter the context in
SKILL.mdfor both opening and discussion rounds. - Boundary markers: The skill uses XML-style delimiters (e.g.,
<original prompt>) to separate untrusted data from the agent instructions. - Capability inventory: It executes shell-based runners and spawns
Agentsub-agents as detailed inreferences/runner-invocations.md. - Sanitization: No explicit escaping or sanitization of the user-provided input is specified, relying on the seats' instructions to remain in a "read-only" interpretation mode.
Audit Metadata