Evolink Router — Smart LLM Routing (Claude, GPT, Gemini, DeepSeek, Kimi)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:24 AM UTC
• Version: 2.0.0

Overview

This skill is a disclosed LLM router that sends prompts through Evolink to selected model providers, with no hidden executable code found.

Install only if you are comfortable sending prompts, files, and task context to Evolink and possible upstream model providers. Avoid using it for secrets, regulated data, or internal-only material unless Evolink and the selected providers meet your privacy, retention, and data-residency requirements; review the OpenClaw config change before enabling broad spawn behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: These examples involve calendars, email, and other likely sensitive user data, yet the documentation does not warn that such content may be transmitted to third-party models via a shared API layer. That omission is dangerous because users may unknowingly expose personal, business, or regulated data to external vendors and retention policies they did not intend to use.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest positions the skill as a router that auto-dispatches tasks to models, but multiple examples describe spawned execution of workflows that read files, compile code, retain outputs, and orchestrate tools. That documentation makes the skill appear to perform substantive task execution, not merely routing, which is a broader behavior than the manifest description suggests.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The guidance routes Chinese-language tasks to specific Chinese-focused vendors and English tasks elsewhere without mentioning user choice or data residency implications. This is risky because language becomes an implicit proxy for cross-border routing and vendor selection, potentially sending sensitive content to jurisdictions or providers the user would not have chosen.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes this skill as a routing brain for dispatching tasks across 20+ text models via Evolink API. These examples document routing to an external 'Evolink Media Skill' for image, video, and music generation, which goes beyond LLM/text-model routing and broadens the advertised behavior of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The cascade examples imply the router inspects ambient user context and operational data to infer intent and perform progressively deeper substantive analysis. In a routing skill, that creates a data-minimization and scope-expansion risk: sensitive context may be examined or forwarded to multiple models/vendors without explicit user awareness, increasing exposure and creating unexpected decision-making authority.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to send prompts and content to `direct.evolink.ai` using a bearer token, but it does not clearly disclose that user inputs, files, and potentially sensitive task data will leave the local environment and be transmitted to a third-party service. In a routing skill that may handle arbitrary user tasks, this omission can cause unintentional data exfiltration or privacy/compliance violations because operators may assume requests stay within their primary model providers or local tooling.

External Transmission

Medium

• Category: Data Exfiltration

Content

---

## Curl Examples

### Claude (Anthropic format)

• Confidence: 93% confidence
• Finding: The curl examples normalize sending arbitrary message content and an API key to an external endpoint, which is an external transmission path by design. In the context of a smart router skill that auto-dispatches tasks across multiple vendors, this is more dangerous than a simple API example because users may unknowingly forward confidential prompts, code, or business data beyond their trust boundary.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The routing rules automatically direct Chinese-language or Chinese-ecosystem tasks to specific Chinese-focused models without documenting user choice, consent, or jurisdictional/data-governance implications. Because task language can correlate with user identity, region, or regulated content, silent routing can expose data to providers with different legal regimes, privacy expectations, or security postures than the user intended.

Static analysis

No suspicious patterns detected.