Security audit

Skill Router

Security checks across malware telemetry and agentic risk

Overview

This router mostly performs skill selection, but it also exposes under-scoped plans and fallback commands that can email, download files, and use credentials, so it should go to Review.

Install only if you are comfortable with a router that may recommend multi-skill workflows and fallback commands, not just rank skills. Require explicit confirmation before any email, download, browser automation, account API, or credential-backed action, and prefer running it where model downloads and environment variables are controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill advertises access to environment variables and local file reads via the L0 tool layer and local indexes, but the metadata shown does not declare any permissions. Undeclared capabilities reduce transparency and can bypass policy or user expectations, especially because API keys are injected from environment variables and local skill indexes are read from disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: A description-behavior mismatch is security-relevant because users and orchestrators may grant this skill routing-only trust while the underlying implementation reportedly performs broader planning, dependency modeling, chain construction, and scaffold generation. Hidden expansion of scope increases the chance of unintended data exposure, tool invocation, or policy bypass because the skill can influence downstream execution beyond simple ranking.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This router skill defines full operational workflows that culminate in outbound email delivery, which exceeds the stated purpose of routing and skill selection. Scope expansion is dangerous because a component expected to only choose skills can instead trigger side effects and external data transmission, increasing the chance of unintended exfiltration or misuse through indirect invocation.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The daily_research chain adds scheduled-style summarization and email notification behavior that is not implied by a routing engine description. Broadening a router into an autonomous notification workflow creates hidden execution paths and can send generated content externally when a user may only expect recommendation or selection logic.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: An email delivery capability is not justified by the declared purpose of a routing-focused skill and introduces a direct external exfiltration path. In this context, the mismatch is especially risky because callers may trust the component as a selector while it can actually transmit drafts, references, or summaries outside the system boundary.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Multiple chains expose outbound email actions despite the manifest presenting the skill as a router, creating unjustified data-transmission capability. This expands the attack surface and can turn ordinary research or writing requests into external sending flows without the level of scrutiny typically applied to communication tools.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The file is supposed to be a fallback tool catalog for a skill router, but it exposes operational capabilities far beyond routing, including email sending, browser automation, file download, code execution, and access to external APIs. This broadens the attack surface significantly: a routing layer compromise or prompt injection could pivot into outbound communication, local writes, automation, or data exfiltration.

Natural-Language Policy Violations

Medium

Confidence: 76% confidence
Finding: Automatically translating user queries without opt-in can change meaning, mishandle sensitive text, and create processing the user did not expect. Even if described as local, silent language transformation in a routing component can misroute security-sensitive or regulated requests and may conflict with user privacy or consent requirements.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The daily_research trigger keywords are broad enough to overlap with common research-related requests, which can cause unintended activation of a chain that eventually sends email. Because this skill already includes side effects, ambiguous triggering is more dangerous than in a read-only skill: benign queries could be routed into external-transmission workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The chain includes an email transmission step without nearby disclosure that generated content will be sent externally. Hidden or weakly disclosed data egress undermines informed consent and can lead users to provide sensitive drafts or references under the mistaken belief the skill only performs internal routing or formatting.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The search_and_email chain performs email sending without an explicit warning about external delivery. In a routing-themed skill, that omission is particularly problematic because users may not expect network egress or persistence outside the platform when asking for literature help.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The daily_research chain sends generated summaries by email but does not provide explicit warning language near the definition. Combined with broad trigger terms, this increases the chance of unnoticed external sharing of research content and makes accidental data transmission more likely.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger terms in this range are very broad action words such as listing, showing, giving, or imperative fragments that commonly appear in ordinary conversation. In a skill router, these generic terms can cause unintended activation or misrouting, sending benign informational queries into higher-privilege or higher-cost skills when no real task intent exists.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: This section includes generic task words like review, analysis, draft, list, task, and git-related terms that are not sufficiently specific to safely indicate intent on their own. In a router that selects among many skills, such weak signals increase false positives and may activate powerful execution or content-generation skills from ambiguous user input.

Vague Triggers

High

Confidence: 96% confidence
Finding: The action-phrase exemption list contains extremely broad triggers such as "给我" and the single-character "把", which are common in ordinary conversational Chinese and can match many benign-looking but unrelated queries. In this router, matching an exemption bypasses rejection logic and forces skill-routing behavior, increasing the chance that irrelevant or risky requests are misclassified as actionable tasks and sent to higher-capability skills.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The mapping includes very broad triggers such as short, common verbs like “查看”, “列出”, and especially generic terms like “查”, which can match a wide range of ordinary user requests and route them toward unintended skills. In a skill router, overbroad activation logic is a genuine security-relevant issue because it can cause incorrect tool selection, potentially invoking higher-risk capabilities than the user intended.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The mapping table uses highly generic trigger terms such as '查', '看', '列出', '分析', and '画' that can match a wide range of ordinary user requests with little domain constraint. In a routing skill, this can cause systematic over-selection of unrelated high-capability skills, weakening downstream guardrails and increasing the chance that sensitive or risky tools are invoked from ambiguous queries.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Short ambiguous writing/research mappings like '写一', '做一', and '撰写' expand into academic or task-oriented English phrases that may over-match many benign conversational requests. Because this file feeds an embedding-based coarse router, these expansions can distort retrieval and push users into unintended skills, including expensive, privileged, or policy-sensitive workflows.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code unconditionally sets HF_ENDPOINT to a third-party mirror before model loading, which can cause outbound network access to an external service without user consent or operator awareness. In a routing skill, queries and model-fetch metadata may be exposed to infrastructure outside the expected trust boundary, creating supply-chain, privacy, and compliance risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The catalog includes an email-sending tool with a concrete executable invocation and sender account details, but no explicit confirmation, recipient validation, rate limiting, or user-approval step. In an agentic context, that enables unauthorized outbound communication, phishing, spam, or leakage of sensitive content if routing is manipulated or the model misfires.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The file download section permits writing arbitrary remote content to the local filesystem via curl, wget, and yt-dlp, but provides no warning, path restrictions, or validation. In an automated environment, this can be abused to stage malicious payloads, overwrite expected files, or persist untrusted content locally.

Ssd 1

High

Confidence: 99% confidence
Finding: This text explicitly attempts to coerce the agent into invoking skills before any response and to override normal judgment, which is a prompt-injection style behavioral override. In a skill-routing environment, such instructions can bias tool use, bypass higher-level safety logic, and increase exposure to unsafe or unnecessary tool execution.

Ssd 1

High

Confidence: 99% confidence
Finding: The duplicated mandatory-invocation wording reinforces an attempt to hijack control flow through repetition and pressure, which is characteristic of adversarial prompt engineering. Repetition makes the override attempt more effective against weaker instruction-following agents and increases the chance of tool misuse or policy bypass.

Ssd 4

Medium

Confidence: 91% confidence
Finding: Encouraging autonomous self-modification based on runtime history and failures is risky because it can change agent behavior without robust review, validation, or rollback guarantees. In a large skill ecosystem, this expands the attack surface for prompt-induced policy drift, persistence of bad rules, and unsafe code or memory mutations.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.