ClawHub
Back to skill

Security audit

Model Router

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for model routing and shows no hidden exfiltration, but it deserves review because it stores AI provider keys and encourages routing potentially sensitive work to third-party models without clear privacy guardrails.

Review before installing if you handle private, regulated, or business-sensitive data. Only configure provider keys you are comfortable storing locally, verify which provider/model each alias actually uses, redact sensitive inputs before routing, and confirm your organization allows those providers to process the data you send.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documents shell execution and file-writing behavior, including running Python scripts and creating credential files, but does not declare corresponding permissions. This can mislead users and policy systems about the skill's capabilities, reducing informed consent and allowing broader access than expected once invoked.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation claims API keys are never logged or printed, yet it includes a sample `.api-keys` file with realistic raw key formats inline. Even if illustrative, this normalizes exposing secrets in docs and may lead users to paste real keys into logs, screenshots, or shared files, undermining the stated security model.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are very broad, such as 'switch model' or 'which model should I use', which can cause the skill to activate during ordinary conversation rather than deliberate configuration. In this skill's context, unintended invocation is more dangerous because activation may lead to task routing, shell commands, credential setup, or transmission of prompts to external providers.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The description emphasizes optimization and provider support but does not clearly warn that user prompts and possibly sensitive task data may be sent to third-party AI providers. In a routing skill whose core purpose is delegating tasks across multiple vendors, lack of upfront disclosure undermines user consent and can expose confidential data to external services unexpectedly.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples encourage sending emails and documents to spawned model sessions without any warning that their contents may be transmitted to external AI providers or retained in separate session contexts. In a model-routing skill that explicitly supports multiple third-party providers, this omission can lead users to unintentionally disclose sensitive personal, business, or regulated data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.