multi-llm-advisor
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to send local project context, architecture details, and source code to external APIs (OpenAI Codex and Google Gemini). While this is the core functionality, users should be aware that sensitive or proprietary information will be transmitted to these third-party providers.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data such as error logs and source code, which is then interpolated into prompts for downstream LLMs. A malicious actor could embed hidden instructions within the code or context to influence the advisor's output.
- Ingestion points: Processes user-provided code, architecture descriptions, and error symptoms via the
{code},{context}, and{error}variables inSKILL.md. - Boundary markers: Uses simple text headers (e.g.,
CONTEXT:,CODE:) to separate data from instructions, but lacks cryptographic delimiters or specific instructions to the models to ignore embedded commands. - Capability inventory: The skill utilizes network capabilities to communicate with the OpenAI and Google AI APIs via referenced TypeScript scripts.
- Sanitization: There is no evidence of input filtering or sanitization to prevent adversarial instructions from affecting the secondary models.
Audit Metadata