Smart Model Switcher

• Analyzed: May 14, 2026, 6:48 AM
• Findings: 1
• Version: 3.0.0
• Hash: 4b284daf263ad204dfae2d71701e30126847efd6bf4cfc70cf6ced0f4f33bf7f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle describes a multi-provider model switcher that requires sensitive API keys for several LLM services (Bailian, MiniMax, GLM, Kimi). While the documentation (SKILL.md, README.md) claims to perform 'API Key validation' and 'Plan detection,' the actual implementation scripts (e.g., scripts/runtime-switch.ps1 and scripts/auto-monitor.ps1) are missing from the provided files. This lack of transparency regarding how credentials are handled, combined with the request for high-value secrets and the execution of background monitoring services, presents a potential risk for data exfiltration or unauthorized access.