external-model — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited external-model (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Shells out to a different AI model via one of three external agentic CLIs — opencode, cursor-agent, kiro-cli — and returns its answer. Four common requests all reduce to this same mechanism, just framed differently:
Don't overthink which framing applies — resolve a CLI/model (see Resolution below) and invoke the dispatcher.
Call scripts/run-model.sh, resolved to an absolute path relative to this skill's own directory (e.g. <skill-dir>/scripts/run-model.sh). The prompt is a single positional argument; quote it so multi-line or complex prompts arrive as one argv element.
run-model.sh "prompt" # default: read-only, sandboxed, 120s timeout
run-model.sh --cli <opencode|cursor-agent|kiro-cli> --model <m> "prompt"
run-model.sh --write "prompt" # allow file edits in the repo
run-model.sh --all "prompt" # every installed CLI, forced read-only, side-by-side
run-model.sh --dry-run "prompt" # print resolved command without running
run-model.sh --context <file> "prompt" # prepend file contents to prompt
run-model.sh --timeout <sec> "prompt"
run-model.sh detect # list installed CLIs
run-model.sh config show # show resolved config
run-model.sh config set --cli <cli> [--model <m>] # persist a defaultDefault runs execute in a throwaway temp directory: the external model cannot mutate the repo, but it also cannot see repo files — it has no access to your working tree at all. So a read-only "opinion about this code" request only works if you embed the relevant code/context directly in the prompt yourself before calling the dispatcher. Use --write only when you genuinely want the external model to read and edit files in the real repo — it then runs with repo access and edit permission, not in the sandbox.
--all is the best choice for second-opinion requests: it fans the same prompt out to every installed CLI in parallel and returns the answers side by side, always read-only regardless of --write. It does not forward --model: each CLI runs with its own default model, because model names are not portable across these CLIs. If you also pass --write, the dispatcher prints a one-line note that --write is ignored and proceeds with read-only mode.
This skill delegates your prompt (and any --context file contents) to a third-party CLI/binary and its associated model provider. That is its purpose, but it also expands the trust boundary: the external CLI runs with its own credentials, code, and safety policy.
external model cannot read or edit your real repo unless you explicitly opt in.
the repo root (via git rev-parse --show-toplevel, regardless of which subdirectory you invoked from) and passes its force/trust flag where the CLI has one (cursor-agent --force, kiro-cli --trust-all-tools), allowing it to edit files and bypass any approval prompts the CLI would normally show. opencode has no trust flag and is unrestricted whenever it isn't sandboxed, so --write for opencode lifts the sandbox without passing a flag. Only use --write when you want the external model to mutate the repo.
prepended to the prompt and sent to the external model. Do not use it on files you would not paste into that model's chat UI.
opencode, cursor-agent, or kiro-cliinstalled from their official sources. The skill has no way to verify the provenance of an arbitrary binary on PATH.
argument separated by --, so a prompt starting with - cannot be misinterpreted as a CLI flag. Still, treat the prompt itself as untrusted third-party content when it originates from outside the current session.
/external-model <prompt> — run a prompt through the resolved default CLI/external-model config set --cli opencode --model openai/gpt-5 — persist a default/external-model config show — print the resolved configThe shorthands set / show are accepted as aliases for config set / config show (the script treats run-model.sh set ... exactly like run-model.sh config set ..., and run-model.sh show like config show), so neither ever runs a model with a literal "set"/"show" prompt.
When the user doesn't pin a CLI explicitly, resolve in this order:
--cli, --model).claude/external-model.config~/.claude/skills/external-model/configuser which one** — then re-invoke with --cli <their choice>. Do not guess.
Passing --cli alone (no --model) uses that CLI's own default model — it does not inherit a MODEL from config.
config set writes only the global file (~/.claude/skills/external-model/config). A per-repo override at .claude/external-model.config (lines of KEY=VALUE: CLI=..., MODEL=...) is hand-authored by the user — the skill reads it but never writes it. Don't create or edit that file on the user's behalf.
Omitting --model from config set --cli X clears any previously-stored MODEL= line in the global config and leaves the new state as CLI=X only. To restore a model later, run config set --cli X --model M.
Each CLI (opencode, cursor-agent, kiro-cli) must be installed and authenticated independently of this skill; kiro-cli headless mode specifically requires KIRO_API_KEY to be set. Read references/cli-matrix.md when you need exact per-CLI install checks, invocation flags, model-name formats, or auth/timeout gotchas — don't inline that detail here.
Before shipping a change to this skill, verify:
name matches the folder name (external-model)description includes trigger phrases ("Use when...") and is under 1024 charsscripts/run-model.sh, references/cli-matrix.md) are referenced, not inlinedREADME.md and .claude-plugin/plugin.jsonbash scripts/validate-skills.sh passes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.