model-router
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected. The skill provides a local utility to manage routing rules between various LLM providers.
- [COMMAND_EXECUTION]: The
scripts/model-router.jsscript safely parses command-line arguments and handles routing logic through standard control flow. It does not utilize dangerous dynamic execution functions such aseval()orexec(). - [DATA_EXFILTRATION]: The script checks the environment for the existence of API keys (e.g.,
ANTHROPIC_API_KEY) to determine provider availability. This check is limited to verifying the existence of the variable and does not read or transmit the secret values. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection but no dangerous capabilities to leverage it. 1. Ingestion points: The
--promptand--filearguments inscripts/model-router.js. 2. Boundary markers: None present. 3. Capability inventory: Local file read/write access to.model-router.jsoninscripts/model-router.js. 4. Sanitization: None. The provided prompt is treated as a static data string and is not executed or interpreted as instructions.
Audit Metadata