token-efficient-task-router

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:38 AM UTC
• Version: 0.6.8

Overview

This skill is a disclosed task-routing and safety-gating prompt package; the main caveats are Chinese-centric defaults and incomplete packaging metadata, not malicious behavior.

Install this only if you want a general control-layer skill that may slow broad or risky tasks to ask for scope and confirmation first. It is best suited to Chinese or bilingual workflows unless you are comfortable adapting prompts to your language. Treat the included packaging scripts as developer utilities and review the missing LICENSE/VERSION packaging issue before redistributing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (67)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about runtime agent behavior: classifying user requests, selecting operating modes, controlling execution stages, and minimizing token use. The supplied code does none of that. Instead, it is a build/packaging utility that validates the skill folder and writes archive files to the workspace root. This is a materially different primary purpose and introduces undeclared file packaging/output behavior. Therefore the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an operational routing skill used to classify user requests and control execution mode selection (Ask/Plan/Craft/Expert) for token efficiency and confirmation gating. The supplied code does not implement task classification, mode routing, execution control, or interactive confirmation flow at runtime. Instead, it is a package validator/linter for the skill repository itself. Its primary behavior is static validation of file structure and content, plus safety scanning for suspicious patterns. While some checks reference the same conceptual documentation topics (modes, token saving, file safety), that is only to verify the package contains required documentation, not to perform the declared routing behavior. Therefore the code chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/chat_confirmation_affordances.md (reported line 152)May include surrounding context.

md

## Safety note

Button-friendly does not override safety gates.

If the user taps an unsafe option, the skill must still intercept and move to a safer flow.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/chat_confirmation_affordances.md (reported line 152)May include surrounding context.

md

## Safety note

Button-friendly does not override safety gates.

If the user taps an unsafe option, the skill must still intercept and move to a safer flow.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/mode_router.md (reported line 92)May include surrounding context.

md

- multi-step or batch -> Plan
- repeated failure -> Expert recommendation

## User choice override policy

Honor the user's requested mode when safe.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.en.md (reported line 103)May include surrounding context.

md

### 4. File safety gates

Without confirmation, it does not encourage:

- overwriting core files
- deleting files

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md

### 4. File safety gates

Without confirmation, it does not encourage:

- overwriting core files
- deleting files

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown specifies a default output target in Chinese characters for Ask Mode, which implies the skill should respond in Chinese by default. Similar Chinese-only defaults are repeated for other modes, and the file does not clearly offer users a language or locale choice or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This line directs Plan Mode outputs to a default measured in Chinese characters, indicating a Chinese-language response policy. Because the skill targets multiple general-purpose agent systems and does not document a justified locale restriction, this is a language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill defines Craft Mode output size in Chinese characters, effectively prescribing Chinese as the default language for responses. There is no accompanying opt-in, language negotiation, or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

These token budget definitions are written as Chinese-character ranges and include Chinese trigger phrases, which creates an implicit Chinese-language default for a broadly scoped skill. The file does not state that these limits apply only when the user is interacting in Chinese or provide an alternative for other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown example presents both the user request and the sample response entirely in Chinese, with no indication that language choice is optional or user-selected. That creates a natural-language policy concern because the skill behavior appears to assume a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example user request and sample response are entirely in Chinese, and the file does not indicate that this language choice is optional or limited to a region-specific use case. This creates a natural-language policy issue because it implicitly enforces a locale/language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example user request and the entire sample response are written in Chinese, with no indication that language choice is optional or user-configurable. This can violate a language/locale policy when a skill implicitly requires or defaults to a specific language without documenting opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown example presents both the user request and the sample response entirely in Chinese, with no indication that language selection is optional or tied to a region-specific use case. That creates a natural-language policy concern because it implicitly enforces a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example user request and the sample response are entirely in Chinese, and the file does not indicate that language selection is optional or limited to a China-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's example user request and recommended replies are entirely in Chinese, including the required follow-up options like 1继续 and 2展开. This indicates a language-specific interaction pattern without any opt-in, alternative locale support, or explanation that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example user request and the recommended response are both written entirely in Chinese, and the file does not indicate that language selection is optional or limited to a China-specific use case. This creates a natural-language policy concern because it implicitly constrains interaction to a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example request and sample response are entirely in Chinese, and the output section presents Chinese as the required response format without offering any language choice or stating that the skill is region-specific. This can violate language/locale policy when a skill implicitly enforces a specific language rather than letting the user opt in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example invocation '帮我处理一下这个文件夹。' is a generic request to handle a folder and does not define clear scope, allowed actions, or exclusion conditions. In a markdown skill description, this kind of broad phrasing can match many ordinary file-related requests and may cause unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file defines ambiguous request patterns exclusively in Chinese and does not indicate that other languages are supported or that the skill is intentionally limited to Chinese-speaking users. This creates a natural-language policy concern because it imposes a locale-specific interaction model without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file specifies a fixed output requirement of '300-1000 Chinese characters,' which imposes a language/locale constraint on responses. This is a natural-language policy issue because the skill does not offer the user a language choice or explain a justified region-specific need for Chinese-only output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill hard-codes user-facing scope and test-gate choices in Chinese without offering a language fallback or matching the user's language. In multi-agent or end-user environments, this can cause users to misunderstand confirmation gates, make unintended selections, or be unable to provide informed consent for code-reading, editing, or test execution scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill hard-codes Chinese as the output language ('target length: 100-800 Chinese characters') without any user opt-in, locale detection, or documented justification. This can cause unauthorized language switching, degrade usability, and create downstream safety/compliance issues if users or integrated systems expect responses in another language.

Content

No source excerpt is available for this finding.