Security audit

A.I. Smart Router

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AI model router, but it should be reviewed because it can automatically send ordinary user prompts to different enabled model providers and persist routing telemetry with limited user control.

Install only if you are comfortable with an automatic router deciding which enabled AI provider receives each prompt. Use it with non-sensitive workflows unless you can restrict providers, disable silent cross-provider fallback/retry, review live versus dry-run mode, and periodically inspect or purge ~/.openclaw router logs and state files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and demonstrates capabilities that imply environment access, filesystem interaction, and network use, but it does not declare corresponding permissions. This creates a trust and review gap: operators may enable the skill believing it is low-privilege while it can read secrets, persist data, and call external providers, increasing the chance of unintended data exposure or unsafe deployment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior materially understates and misrepresents what the skill does, including persistent state, logging, spawning sub-agents, and weakly substantiated security/redaction claims. In a router that may handle sensitive prompts and provider credentials, this mismatch is dangerous because users and reviewers cannot accurately assess data flows, retention, delegation, and external exposure.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module-level documentation states that dry-run mode only logs routing decisions, but the constructor later allows the loaded configuration to silently override the caller-supplied mode, including switching to live mode. In a skill context, this can cause unexpected model-selection changes and bypass operator expectations or higher-level controls that believed the hook was non-mutating.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly promises a silent retry to Gemini on context overflow and JIT compaction of older content, but it does not clearly warn users that their prompt may be resent to a different external provider or transformed before processing. In a multi-provider router, silent cross-provider retransmission and content summarization can violate user expectations, privacy requirements, or data-handling policies even if no exploit code is present.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation says the router auto-detects configured providers and automatically selects the best model, but it does not clearly and upfront state that user prompts may be sent to any enabled third-party provider. That creates a real data-sharing risk because users may assume a single-provider path while the skill can distribute content across Anthropic, OpenAI, Google, or xAI based on routing logic.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The fallback section describes automatic switching to the next model when the primary fails, but it omits an upfront warning that the same request content may be retried with another provider. This is dangerous in environments with confidentiality, compliance, or contractual limits because a transient failure at one vendor can silently expand disclosure of the user's data to additional vendors.

Vague Triggers

High

Confidence: 94% confidence
Finding: The skill is designed to activate silently on ordinary user messages with no clear trigger boundaries, causing broad interception and routing of potentially all conversations. In this context, that means sensitive prompts may be automatically classified, logged, delegated, or sent to external model providers without deliberate user intent or sufficiently narrow scoping.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: When delegation is enabled, the executor copies the entire user message into `spawn_params['task']` and forwards it to a different model or agent without any minimization, consent gate, or policy check. In a router explicitly designed to send requests across multiple providers, this can leak sensitive prompts, credentials, personal data, or proprietary content to third-party systems beyond the user's expected processing boundary.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The routing matrix uses broad keyword triggers across domain and risk categories, which can match ordinary user phrasing and steer requests into unintended models or workflows. In a security-sensitive router, misrouting can weaken guardrail selection, increase cost, or bypass the model best suited for safety-critical handling.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The SYSTEM_ROUTINE keywords include vague triggers such as terms akin to 'list', 'simple', 'quick', or 'brief', which are common in benign prompts across many higher-risk domains. This can cause underpowered or less rigorous model selection for tasks that actually require stronger reasoning or security review, creating reliability and safety degradation.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The realtime trigger list uses very broad keywords such as "now", "today", "current", and "latest", which are common in ordinary prompts and can cause the router to select realtime-capable models unexpectedly. In a live routing system, this can expand data exposure to additional providers, alter trust-tier decisions, and increase cost or policy bypass risk when simple queries are misclassified as needing realtime access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: execute_with_silent_retry can resend the same user messages to a different provider after an overflow-like error without explicit user disclosure or consent. In a router that brokers requests across multiple third-party AI vendors, this changes the data recipient and potentially the applicable retention, jurisdiction, and privacy boundaries, which can expose sensitive prompts or conversation history beyond user expectations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code persistently logs routing decisions to disk, including a session identifier and detailed user activity metadata such as intent, complexity, selected model, and timestamps. Even though this file does not explicitly log raw prompts, persistent per-session behavioral telemetry can still expose sensitive usage patterns and create privacy/compliance risk if users are unaware, logs are retained too long, or the files are accessed by other local users or collected centrally.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/security.md:270