Security audit

Smart Model Switcher V2

Security checks for vulnerabilities and agentic risk

Overview

The skill is an automatic model router, but it under-discloses provider routing and includes instructions that could change other sessions despite claiming current-session isolation.

Review before installing. This skill may automatically change which model/provider handles your current conversation and attached files; avoid using it with confidential Office documents, recordings, source code, or regulated data unless you are comfortable with that routing. The publisher should remove the cross-session sessionKey example and clearly document privacy, consent, and the limits of the helper scripts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata promises multimodal automatic switching for images, video, audio, and Office documents, but the implementation only does simple text keyword matching over a task string and returns a model name. This is a deceptive capability mismatch that can cause users or higher-level automation to rely on protections or routing behavior that do not actually exist, increasing the chance of incorrect model handling or unsafe downstream decisions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises automatic model switching based on user content across modalities but does not warn that content may be sent to different models/providers depending on detected task type. That creates a privacy and consent risk because users may unknowingly have text, images, audio, video, or code routed to third-party providers with different retention, processing, or compliance properties.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The Office document section promotes sending document-processing tasks to `MiniMax-M2.5` without any warning about the sensitivity of files such as contracts, spreadsheets, presentations, or internal reports. In context, Office files commonly contain confidential business or personal data, so automatic routing increases the likelihood of unreviewed disclosure to an external model provider.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file repeatedly states that switching is limited to the main window/current session, but then provides contradictory guidance showing how to switch other sessions directly via `sessionKey`. This inconsistency is dangerous because agents may follow the more powerful instruction path, bypassing the stated safety boundary and undermining operator expectations about session isolation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill explicitly documents use of `session_status(sessionKey: "...", model: "...")` to switch models for other sessions, which goes beyond automatic selection for the current conversation. If followed, an agent could modify unrelated user or channel sessions, causing cross-session interference, unauthorized action on other conversations, and possible rerouting of sensitive content to a different provider/model than intended.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The script presents itself as a background auto-monitoring and model-switching service, but it only prints messages and appends log entries. In a security-sensitive agent skill, this kind of deceptive functionality can mislead operators into believing monitoring, switching, or control logic is active when it is not, creating a dangerous false sense of protection and potentially masking missing safeguards.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The inline comments, banners, and feature list repeatedly claim capabilities such as zero-latency switching, auto model discovery, fallback logic, and active request monitoring that the code does not perform. In the context of an agent skill that may influence model routing and user trust, overstated capabilities are dangerous because they can cause administrators or downstream systems to rely on controls that do not actually exist.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: Advertising 'Runtime Zero-Latency Switching' is misleading because the script only performs local classification and prints a chosen model without changing any runtime state. While not direct code execution risk, this can trick operators into believing model-switching controls are active when they are not, undermining trust and operational safety.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The output states 'Restart Required: No' even though no switch is performed and the script has no basis to assert restart semantics. This kind of false status reporting can mislead users during deployment or troubleshooting and conceal that no effective change occurred.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The usage example is presented in Chinese text and the script's keyword mappings are heavily oriented toward Chinese-language inputs, with no visible indication that users can choose their preferred language or locale. This can violate language-choice policy when a skill implicitly expects or prioritizes one language without opt-in or justification.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as a general-purpose automatic switcher, but does not offer any user language choice or explain a region-specific limitation. For a broadly applicable skill, forcing a single language can violate language/locale policy when no opt-in or justification is provided.

Static analysis

No suspicious patterns detected.