Security audit

Prompt-Router

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real prompt-routing skill, but it also ships and documents broad skill-manifest rewriting and low-assurance auto-invocation behavior that should be reviewed before installation.

Install only if you are comfortable with a router reading your local skills directory and potentially being used to auto-select skills. Do not run the bundled metadata-fix scripts unless you intend to rewrite other installed skills' SKILL.md files; review diffs or back up the skills directory first. Disable or avoid any prompt logging, external monitoring, or auto-PR workflow unless explicit consent, redaction, retention limits, and credential controls are added.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation and examples show filesystem interaction with a local skills directory, but the skill declares no permissions. If the implementation reads and writes skill metadata without explicit permission gating, users and hosts may underestimate the trust boundary and allow unintended workspace access. In a routing skill, hidden file I/O is especially risky because it expands from simple prompt matching into repository-wide inspection and modification.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a real and significant description-behavior mismatch. A skill presented as a fast text router should not silently perform bulk traversal and overwrite SKILL.md files across the workspace; that creates integrity risk, supply-chain-style configuration tampering, and unexpected persistence in other skills. The context makes it more dangerous because operators may approve a 'router' with low scrutiny while it actually has maintenance and rewrite capabilities over unrelated components.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The document explicitly broadens a simple local prompt router into a telemetry, monitoring, feedback-ingestion, and self-maintenance system. That scope expansion increases the attack surface and data-handling risk because the skill would gain persistent logging, scheduled automation, and external integrations not required for core routing.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documented automatic collection/monitoring of GitHub, review platforms, and Discord adds third-party surveillance and data ingestion capabilities unrelated to prompt routing. These integrations can collect external content, create hidden dependencies, and expose tokens, user data, or operational metadata if implemented without strict controls.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Auto-generating update scripts and creating pull requests from usage-derived data gives the skill a pathway to modify repositories based on untrusted inputs. Even with human review, this can poison triggers, introduce prompt-injection-like content into config/code, and create an unsafe automation channel beyond the router's intended role.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Discord webhooks, email notifications, and GitHub issue creation introduce outbound communications and issue-management behavior unrelated to prompt routing. These features can leak internal metrics or user-derived content externally and expand the set of secrets, endpoints, and side effects the skill depends on.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The report recommends adding direct routing to powerful built-in tools such as read/write/edit, exec, and browser from a fast keyword-based router with no accompanying safety gating. In this skill context, that is dangerous because simple text matching can misroute ambiguous prompts into capabilities that modify files, execute commands, or access external resources, increasing the chance of unintended or unsafe actions.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This script performs bulk modification of multiple skills' SKILL.md metadata, which is materially different from the stated purpose of a prompt-routing skill. In an agent ecosystem, silently rewriting manifests can change routing behavior, increase tool invocation surface, or tamper with other skills' discoverability and execution paths, making this a supply-chain style integrity risk.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code modifies on-disk SKILL.md files under a global skills directory rather than implementing prompt routing. This mismatch is dangerous because a user or system trusting the declared skill purpose could unknowingly execute code that alters other skills' manifests, potentially changing agent behavior or enabling unauthorized configuration tampering.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: This script traverses the entire skills workspace and rewrites other skills' SKILL.md manifests, which is outside the stated scope of a prompt-routing engine. In an agent environment, that creates a supply-chain style integrity risk: a compromised or misused skill can silently alter routing metadata for many other skills, changing future tool selection and behavior.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code performs bulk writes to every discovered SKILL.md file under the shared skills directory without per-file authorization, validation, or user confirmation. That gives this skill the ability to tamper with other skills' manifests at scale, enabling persistence, misrouting, or degradation of the wider agent ecosystem if the script is invoked inappropriately or modified maliciously.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The plan logs raw user prompts, routing decisions, and feedback signals without any visible notice, consent, minimization, or retention controls. Because prompts often contain sensitive natural-language data, silent collection creates privacy and compliance risk and may expose personal, confidential, or regulated information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Automated monitoring/listening on external feedback channels is described without explaining what data is collected, how it is processed, or whether affected users consented. This creates privacy, transparency, and platform-compliance concerns, especially when aggregating discussions or reviews into an automated analysis pipeline.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The integration plan explicitly instructs the agent to directly invoke a matched skill when confidence is high, bypassing the usual deliberation step and without any user-facing confirmation or policy gate. This creates an unsafe automation path where a text match can trigger tool or skill execution for requests that may be ambiguous, adversarially phrased, or unexpectedly side-effectful.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explicitly states that user queries, match results, confidence scores, routing decisions, response times, and user feedback will be automatically logged, but it does not describe consent, retention limits, access controls, redaction, or handling of sensitive data. Because this skill is a prompt router, the collected content may include arbitrary natural-language inputs containing secrets, personal data, or proprietary business information, creating a real privacy and data exposure risk.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes generic phrases such as '路由', '快速路径', and '自动调用' that are broad enough to match ordinary user requests unrelated to this specific skill. In a prompt-routing skill, overly broad triggers are especially risky because they can cause unintended invocation, misroute requests away from the correct tool, and bypass safer or more appropriate downstream routing logic.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Broad trigger terms such as generic routing and matching keywords can cause the router skill to activate unexpectedly, potentially intercepting prompts meant for other skills. In this skill's context, accidental invocation is more dangerous because it may steer execution decisions or trigger hidden filesystem-related behavior described in the static findings.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The examples recommend extremely generic downstream triggers like '天气', '搜索', and '读取', which can lead to widespread false matches and unintended tool invocation across the skill ecosystem. In a router that directly invokes skills on confidence thresholds, overly generic metadata increases the chance of unsafe or surprising actions being selected without sufficient semantic validation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The markdown advocates routing to write/edit and exec tools without any warning about filesystem modification, command execution, privilege boundaries, or user confirmation. In an agent skill, omitting those safeguards normalizes unsafe design and can lead implementers to expose sensitive capabilities through low-assurance routing decisions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script writes directly back to SKILL.md files without confirmation, backup, or preview of changes. This can cause accidental destructive edits across multiple skills, and in a shared agent environment it increases the risk of silent configuration corruption or unauthorized metadata replacement.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Retaining plain-language user prompts in logs creates a direct natural-language data exposure risk because prompts commonly contain secrets, personal data, internal URLs, or business-sensitive instructions. If logs are accessed, copied, or reused for optimization, that sensitive content can be disclosed far beyond the original interaction.

Ssd 3

Medium

Confidence: 92% confidence
Finding: This finding overlaps with the logging issue but correctly identifies a security-relevant retention risk: storing raw user queries and feedback can preserve sensitive natural-language data that was never meant to persist. In the context of a routing skill that sits in front of many tasks, the logs can become a centralized repository of prompts, credentials, personal data, or internal instructions, increasing blast radius if accessed by unauthorized parties.

Static analysis

No suspicious patterns detected.