context-skills-hub-model-router-setup
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Performs global installation of packages and executes command-line interface tools for Claude Code and Codex.
- [EXTERNAL_DOWNLOADS]: Downloads CLI tools from official Anthropic and OpenAI package registries.
- [DATA_EXFILTRATION]: Accesses and reads local AI agent configuration files, such as
~/.claude/CLAUDE.mdand~/.codex/AGENTS.md, along with other user-specified directories to import content into a shared Notion database. - [PERSISTENCE]: Modifies local configuration files for AI agents to automatically load external context and skills at the beginning of every session.
- [DYNAMIC_EXECUTION]: Configures AI agents to dynamically load and execute instructions and skills maintained in a remote Notion database.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a centralized hub that aggregates data from external AI platforms (Claude/ChatGPT memories, custom instructions) and local files. This content is used to steer agent behavior without established boundary markers or rigorous sanitization.
- Ingestion points: Data imported from Claude/ChatGPT memories, history, and custom instructions, as well as local files like
~/.claude/skills/and other prompt folders, all stored in a Notion hub. - Boundary markers: None identified; instructions do not specify the use of delimiters or 'ignore' instructions for ingested content.
- Capability inventory: Includes global package installation (
npm), execution of external CLI tools (claude,codex), and modification of local configuration files. - Sanitization: Relies on a third-party scanner for external skills, but lacks automated sanitization or validation for imported context data.
Audit Metadata