T09 · Insecure Skill Coding Practices
Error
- Location
executor.py:251- Finding
Credential Filtering Is Bypassed by the Live Delegation Path
- Content
View full analysis
- Remediation
View remediation
Security audit
A.I. Smart Router
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent model router, but it can silently send prompts to other providers and its executable delegation path bypasses the promised credential filter.
Review this skill carefully before installing. It is not backed by evidence of intentional theft or destructive behavior, but it is designed to route normal prompts among external model providers, and the shipped code has a real sanitizer bypass in the live delegation path. Avoid using it with secrets, health data, financial records, customer data, or proprietary material unless you add explicit provider allowlists, user confirmation before cross-provider routing, and a single enforced sanitization path for all delegation and fallback flows.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T07 · Tool Hijacking and Spoofing
Warning
- Location
dashboard.py:254- Finding
Dashboard Reports Fabricated Security-Event Counts
- Content
View full analysis
dict[str, int]: """Get security event summary for today.""" # In a full implementation, this would read from a security log # For now, return placeholder based on logged decisions # These would be tracked by the sanitizer in production return { "blocked": 1, # We blocked one request in dry run "pii_warnings": 0, "credentials": 1, # The test key we caught } ``` ### Technical Analysis The dashboard presents fixed test values as if they were current security-event measurements. It always reports one blocked request and one detected credential, regardless of whether the sanitizer processed any requests or whether the live executor bypassed it. Although comments identify the implementation as a placeholder, the rendered dashboard describes these values as operational security statistics. There is no security event log or runtime counter backing the displayed results. This creates false assurance around credential filtering. It is particularly consequential because the live delegation path can bypass that filtering entirely. ### Attack Path 1. Requests are processed through the executor path that bypasses input sanitization. 2. Sensitive content can be delegated without generating a sanitizer event. 3. An operator opens the dashboard to verify whether security filtering is active. 4. `_get_security_summary()` returns fixed positive detection counts. 5. The dashboard indicates that credentials were caught and requests were blocked. 6. The operator incorrectly concludes that the security control is functioning and may not investigate the underlying exposure. The weakness does not require an attacker to alter the telemetry. The shipped implementation itself produces mislead ...[truncated 668 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual skill introduces disk persistence and CLI inspection/cleanup while omitting that from the description, users and operators cannot accurately assess data retention, exposure of logs, or local attack surface. In an agent skill that may process prompts and provider metadata, undeclared persistence is a real security concern because it can store sensitive content or routing state unexpectedly.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Silent-by-default activation means the skill may engage on ordinary user messages without explicit consent or a narrow invocation pattern. For a router that can choose external providers and inspect message content, overbroad activation increases the chance of unintended provider routing, accidental data disclosure, and unpredictable interference with other skills or system behavior.
- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # Security Best Practices for Model Routing Comprehensive security guidance for multi-model routing systems. --- ## Security Guarantees This skill makes the following security guarantees: | Guarantee | Status | Verification | |-----------|--------|--------------| | No API keys stored in skill files | ✅ Enforced | Grep for patterns; none found | | Credentials via environment only | ✅ Enforced | Keys read from env/auth-profiles only | | Input sanitization before routing | ✅ Implemented | See [Input Sanitization](#input-sanitization) | | No arbitrary code execution | ✅ By design | See [Code Execution Safety](#cod
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
import(user_input) # DOES NOT EXIST
text ### Model Override Safety Even user model overrides are validated against an allowlist:
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
import(user_input) # DOES NOT EXIST
text ### Model Override Safety Even user model overrides are validated against an allowlist:
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 80% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
Watch for attempts to manipulate routing:
text "Ignore previous instructions" "You are now..." "Disregard your programming" "New system prompt:"
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md ### AI-Specific Risks 1. **Jailbreaking attempts** - Users trying to bypass safety 2. **Data exfiltration** - Tricking AI to reveal training data 3. **Model confusion** - Causing wrong model selection 4. **Cost attacks** - Triggering expensive models unnecessarily
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md ### AI-Specific Risks 1. **Jailbreaking attempts** - Users trying to bypass safety 2. **Data exfiltration** - Tricking AI to reveal training data 3. **Model confusion** - Causing wrong model selection 4. **Cost attacks** - Triggering expensive models unnecessarily
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The router's classify path references undefined Phase H symbols and functions such as pre_flight_token_audit, PHASE_H_FORCE_THRESHOLD, and PHASE_H_MODEL, which will cause runtime failure before routing completes. In this skill context, that can disable routing, sanitization-dependent protections, and provider-selection safeguards, creating a denial-of-service condition and undermining the claimed safety controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation states mandatory routing of medical requests to GPT-5.2 without offering user choice or consent. For high-sensitivity domains like health, forced provider selection can route private data to a third party based solely on router policy, creating privacy, compliance, and user-expectation risks even if the model is selected for quality reasons.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly documents a 'silent retry' that intercepts context-overflow errors and reroutes the request to Gemini without notifying the user at the moment provider handling changes. This creates a transparency and consent problem: sensitive prompts may be sent to a different provider than the user expected, undermining data-handling assumptions, auditability, and trust boundaries.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # From your workspace root mkdir -p skills cp -r /path/to/smart-router skills/
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares runtime requirements and presents executable Python snippets and provider interactions, but does not declare an explicit tool/permission scope. In an agent environment, missing least-privilege boundaries can allow the skill to access environment variables, networked model providers, and local state/log files more broadly than users expect. The risk is amplified by references to persistent state, status commands, and provider discovery.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Using broad everyday phrases like 'write', 'explain', 'review', or 'summarize' as activation/intent signals creates a high risk of unintended matching. In a skill that may route requests across providers, broad triggers can cause requests containing sensitive or irrelevant content to be processed by the router when the user did not intend that behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The long-context table states that 128K-200K requests fall back through 'Opus → Sonnet → Gemini Pro' and that 200K-1M uses 'Gemini Pro → Flash'. However, the implementation at L431 includes 'haiku' and 'flash' in the <=200K tier as additional candidates, which expands behavior beyond the documented chain. This is an active intent/documentation contradiction rather than a minor omission because the section is presented as the authoritative fallback policy.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The inline comments at L625 describe COMPLEX as allowing only '$', '$$', and '$$$', but the returned mapping at L657 also includes '$$$$'. Since Opus is documented as '$$$$' elsewhere, the code permits the most expensive tier despite the nearby explanation saying otherwise. This is a direct contradiction in implementation guidance, not merely incomplete documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented 'silent retry with Gemini Pro' behavior can resend failed prompts to a different provider without explicit user awareness or consent. In a router that may handle sensitive prompts, this creates a real confidentiality and compliance risk because data that the user intended for one model/provider could be transmitted to another after an error condition.
- Content
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- references/security.md:270