Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly matches its model-router purpose, but it needs review because its privacy documentation is inconsistent while prompts can be sent to providers and stored locally.
Install only if you are comfortable sending prompts, documents, embeddings, and rerank inputs to the configured model providers. Avoid using it with secrets unless you trust those providers, clear ~/.cn_llm_router data when needed, use --no-cache for sensitive prompts, and prefer ERNIE_OPENAI_KEY over the legacy ERNIE AK/SK path.
This mismatch notes additional implemented features beyond the declared purpose, such as embed, rerank, session management, arena comparison, health checks, and fallback logic. While not inherently malicious, undocumented extra behaviors expand the operational and network surface area and can surprise reviewers who only assessed the narrower stated purpose.
This mismatch notes additional implemented features beyond the declared purpose, such as embed, rerank, session management, arena comparison, health checks, and fallback logic. While not inherently malicious, undocumented extra behaviors expand the operational and network surface area and can surprise reviewers who only assessed the narrower stated purpose.
This mismatch notes additional implemented features beyond the declared purpose, such as embed, rerank, session management, arena comparison, health checks, and fallback logic. While not inherently malicious, undocumented extra behaviors expand the operational and network surface area and can surprise reviewers who only assessed the narrower stated purpose.
The skill advertises and documents capabilities that involve environment-variable access, local file reads/writes, networking, and shell-style execution patterns, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution surface where a host may grant more authority than users or reviewers expect, increasing the risk of unintended file modification, secret exposure, or network activity.
The invocation guidance says to use the skill when the user needs things like "调用国产大模型", "统一管理多个模型 Key", and especially "识别图片/音频内容", which are broad intents rather than narrowly scoped trigger phrases. Without clearer boundaries or exclusion examples, this could cause unintended invocation for generic AI, media, or key-management requests.
The line explicitly says "所有报错均为中文", which imposes a fixed language choice on all users. This is a natural-language policy issue because the skill does not offer any language selection or opt-in despite being a generally usable tool rather than a clearly justified region-locked compliance workflow.
The FAQ claims prompts are not uploaded except for local classification/cache, yet the core function of the skill is to send prompts to external vendor APIs during model calls. This is a material misrepresentation of data handling and can mislead users into disclosing sensitive information under the false belief that content remains local.
The FAQ says chat is single-turn only and multi-turn support is planned, while other sections claim existing session-based multi-turn support. Contradictory documentation around persistence and history handling is risky because users may unknowingly store conversation history locally or send more context than intended to providers.
The file explicitly states errors are raised in Chinese and all docstrings/messages are written only in Chinese, which imposes a specific language behavior. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified as region-specific, neither of which appears here.
The OAuth2 token request places the AK and SK in the URL query string, which can be exposed through HTTP client logs, proxy logs, monitoring systems, browser/history equivalents, or error traces even when sent over HTTPS. In this skill context, the code is a model-routing adapter that centrally manages multiple provider credentials, so accidental credential exposure is more sensitive because compromise of one adapter can enable unauthorized model usage and billing abuse.
This file contains natural-language documentation and runtime messages exclusively in Chinese, which effectively forces a specific language on users and operators. Under the stated policy, locale-specific language is a violation unless the skill offers opt-in language selection or clearly documents a justified regional constraint.
This is a real implementation flaw: _ws_chat() references websocket without that name being available in its scope, so any call path reaching it will fail at runtime and break the adapter's transport layer. In a router that centralizes multiple model providers, this creates a reliable denial-of-service condition for the Spark backend and can mislead higher-level logic because the adapter claims compatibility that it does not actually provide.
The file’s natural-language documentation is entirely in Chinese, which imposes a specific language on readers without any opt-in or stated locale-specific scope. Under the policy, language constraints should either offer choice or be clearly justified as region-specific.
This Python file contains its primary natural-language documentation, usage text, and CLI descriptions entirely in Chinese, and it does not offer any language selection or note that the tool is region-specific. That creates a locale-policy concern because the skill effectively assumes a specific language without user opt-in.
This code performs a file write that changes the supplied models.yaml in place, but there is no confirmation prompt or explicit warning immediately before the save. Although the module docstring mentions that scores are written back, the actual destructive modification path lacks a direct runtime disclosure or safeguard.
The file’s natural-language documentation is entirely Chinese and describes the skill’s configuration behavior in a way that presumes a fixed language context. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation, and there is no indication here that users may choose another language.
The module is described as a cost/usage tracker, but it also defines an arena_sessions table with a prompt field and later stores full user prompts there. Persisting raw prompts locally can capture sensitive data users may enter into LLM workflows, creating an unnecessary privacy exposure beyond the stated purpose of billing and observability.
log_arena_vote writes the full prompt string directly into local SQLite without any indication of consent, minimization, or sanitization. In an LLM router, prompts may contain credentials, personal data, proprietary code, or business content, so storing them verbatim expands the attack surface for local compromise, accidental disclosure, or misuse.
The file’s natural-language content, including the module docstring and later user-facing output, is written exclusively in Chinese with no indication that language is configurable or intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill is expected to support user choice rather than imposing a fixed language.
模块文档在 L006 明确声称 resolve_with_fallback() 会“按健康状态过滤”返回主模型和备用列表。但实际实现中，L138-L154 只是将健康状态作为排序因子，且注释还写明“不强制过滤”，因此不健康厂商仍可能进入 backup_list。该文档与实际行为直接矛盾。
The command output shown to users is entirely hard-coded in Chinese, and the file provides no opt-in, negotiation, or alternative locale support. For user-facing behavior, this is a natural-language policy concern because it forces a specific language regardless of user preference.
The module's natural-language documentation is written entirely in Chinese, imposing a specific language choice without any indication of user preference or an offered alternative. This matches the locale/language policy concern for forced language without opt-in.
The translation mock always returns English output without checking the user’s requested target language or preserving the interaction language. This can cause incorrect or misleading behavior in testing, especially for downstream components that assume language selection respects user intent.
The greeting scenario uses very common triggers such as “你好”, “hi”, and “介绍”, which can accidentally match unrelated user inputs and route them to a simplistic mock response. In a routing skill, overly broad triggers can cause unintended invocation, masking user intent and potentially bypassing more appropriate handling paths.
This JSON manifest defines activation keywords for a generic QA scenario using very common phrases such as “是什么”, “为什么”, “怎么”, “如何”, and “推荐”. These overlap heavily with ordinary user speech and the file does not provide narrowing constraints or negative examples, making unintended matches likely.
Detected: suspicious.dynamic_code_execution
