tokenwise
Warn
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install a plugin from an unverified third-party GitHub repository (
CodeShuX/tokenwise). Downloading and installing code from unknown sources poses a risk as the functionality has not been vetted by a trusted organization or well-known service.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for routing user tasks and subagent contexts to different AI models, creating a vulnerability to indirect prompt injection. Malicious instructions within the processed data could influence the agent's behavior.\n - Ingestion points: User-provided task descriptions and subagent context buffers.\n
- Boundary markers: None identified; there are no instructions to ignore embedded commands or use specific delimiters.\n
- Capability inventory: The skill performs model routing via network requests, logs task data to
.tokenwise/log.ndjson, and modifiesCLAUDE.mdandsettings.json.\n - Sanitization: No validation or sanitization of the input data is mentioned.\n- [COMMAND_EXECUTION]: The
/tokenwise:installand/tokenwise:undosubcommands involve file system operations that modify sensitive project configuration files (CLAUDE.mdandsettings.json) and manage backups, which alters the agent's execution environment.
Audit Metadata