ClawHub
Back to skill

Security audit

LLM Council Router

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent model-routing helper, but it can send full user prompts to external services without a clear confirmation or privacy warning.

Review before installing if you may route confidential prompts. Use it only when you are comfortable sending the prompt text to LLM Council and, if you follow the chaining example, to OpenRouter and downstream model providers. Avoid secrets, regulated data, proprietary code, or private files unless your organization has approved those disclosures and billing implications.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:78
Finding

Unrestricted External Prompt Disclosure and Unsafe Shell Command Construction

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it will route prompts to the best model but does not clearly warn that user prompt content is transmitted to external services. This creates a transparency and consent problem: users may reveal sensitive data believing they are interacting locally, while the skill forwards their content to third-party APIs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The invocation guidance is broad enough that the skill could activate on ordinary requests about choosing a model, causing user prompts to be sent externally in many routine contexts. Over-broad triggering increases the chance of unnecessary data sharing and provider calls, especially when users may only be asking for advice rather than consenting to API routing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The curl example instructs sending the user's query directly to the LLM Council API, which is an external transmission of potentially sensitive text. While this is core to the feature, it remains a vulnerability in the absence of prominent user-facing notice and consent because ordinary prompts may contain secrets, proprietary data, or personal information.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

  1. Call the routing API with the user's query:
bash
curl -X POST https://clawbot.llmcouncil.ai/v1/route \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $LLMCOUNCIL_API_KEY" \
  -d '{"query": "USER_QUERY_HERE"}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is described as a router, but the documentation explicitly instructs chaining the routing result into a second provider call that executes the user's prompt on OpenRouter. This expands the trust boundary from 'model selection' to 'prompt transmission and execution by third-party services,' which can cause unintended data disclosure, extra billing, and broader capability activation than the user may expect from the skill name and description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code snippet at this line performs an HTTP POST to an external endpoint with the user's query, constituting external data exfiltration from the local trust boundary. In skill context, this is expected functionality, but it is still a security-relevant behavior because it can leak sensitive prompt content if not clearly disclosed and gated.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
import requests, os

# Step 1: Get the best model from LLM Council
route = requests.post(
    "https://clawbot.llmcouncil.ai/v1/route",
    headers={"X-API-Key": os.environ["LLMCOUNCIL_API_KEY"]},
    json={"query": "Write a Python web scraper"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code snippet at this line performs an HTTP POST to an external endpoint with the user's query, constituting external data exfiltration from the local trust boundary. In skill context, this is expected functionality, but it is still a security-relevant behavior because it can leak sensitive prompt content if not clearly disclosed and gated.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
import requests, os

# Step 1: Get the best model from LLM Council
route = requests.post(
    "https://clawbot.llmcouncil.ai/v1/route",
    headers={"X-API-Key": os.environ["LLMCOUNCIL_API_KEY"]},
    json={"query": "Write a Python web scraper"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The code snippet at this line performs a POST to OpenRouter using a chosen model and forwards the user's message content for completion. This creates a second-hop disclosure path and broadens the operational scope from ranking to execution, increasing risk of sensitive data transfer, cost incurrence, and inadvertent use of a provider the user did not explicitly choose.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
confidence = route["confidence"]   # e.g. 0.85

# Step 2: Call that model via OpenRouter
answer = requests.post(
    "https://openrouter.ai/api/v1/chat/completions",
    headers={"Authorization": f"Bearer {os.environ['OPENROUTER_API_KEY']}"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The code snippet at this line performs a POST to OpenRouter using a chosen model and forwards the user's message content for completion. This creates a second-hop disclosure path and broadens the operational scope from ranking to execution, increasing risk of sensitive data transfer, cost incurrence, and inadvertent use of a provider the user did not explicitly choose.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
confidence = route["confidence"]   # e.g. 0.85

# Step 2: Call that model via OpenRouter
answer = requests.post(
    "https://openrouter.ai/api/v1/chat/completions",
    headers={"Authorization": f"Bearer {os.environ['OPENROUTER_API_KEY']}"},
    json={

Static analysis

No suspicious patterns detected.