Security audit

cn-model-gateway

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed model API gateway; it sends user inputs to configured third-party model providers and keeps local usage databases, with no artifact-backed hidden exfiltration or destructive behavior found.

Install only if you are comfortable sending prompts, documents, and media references to the model providers you configure. Prefer environment variables for API keys, avoid putting config.json in version control, specify a provider or disable failover for sensitive work, and review/avoid the unused _core cache or arena helpers unless you explicitly want local prompt retention.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation describes capabilities to read environment variables, read/write local files, and make outbound network requests, yet no explicit permission declaration is present. In an agent ecosystem, this creates a transparency and consent gap: users or orchestrators may grant or execute the skill without realizing it can access secrets, local data, and remote APIs, increasing the chance of unintended data exposure or unsafe execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented purpose materially diverges from the observed and described behavior, including extra CLI functions, local storage, caching, benchmarking, arena statistics, and inconsistent API key handling. This is dangerous because operators may deploy the skill under a narrower trust assumption ('just an MCP gateway') while it performs broader actions and stores more data than expected, which can lead to secret exposure, unreviewed data retention, or execution of unsupported features with weak safeguards.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The statement '只做标准 MCP 协议网关' understates the real scope of the skill, which also documents benchmarking, price tracking, calibration, history tracking, and non-MCP adapters. Security reviews and deployment approvals often rely on these scope statements, so a misleading minimization of functionality can cause the skill to be trusted in environments where those extra capabilities would have required additional review.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The documentation says usage data '不会上传到任何服务器', but elsewhere repeatedly states that model calls are sent over the network to third-party model providers. This contradiction can mislead users into believing their prompts, files, images, audio, or video stay local when in fact the core function of the skill is to transmit that content externally, creating a serious informed-consent and data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This module is documented as a billing/usage tracker, but it also creates and persists `arena_sessions` with full prompt text and voting metadata. Storing raw prompts expands the data sensitivity far beyond cost telemetry and can capture secrets, personal data, or proprietary inputs that users would not reasonably expect to be retained in a cost database.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly tells users to place API keys into a local config file but does not warn that those credentials will be used for outbound requests to third-party model providers or advise on secure storage. In an agent gateway context that brokers requests to many external APIs, this omission increases the chance of accidental credential exposure, unsafe file handling, or misunderstanding about where secrets are transmitted.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: `log_arena_vote` writes the raw `prompt` into local SQLite without sanitization, minimization, or any visible notice in this module. In an LLM gateway, prompts frequently contain API keys, credentials, personal data, source code, or business-sensitive text, so silent retention creates a meaningful confidentiality and privacy risk even if the database is only local.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The ask_model path forwards arbitrary user-supplied prompts to external model providers without any disclosure, consent, or data-classification guard in this code path. In an agent setting, users may unknowingly send sensitive prompts, secrets, or regulated data to third-party providers, creating privacy, compliance, and confidentiality risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The compare_models path amplifies data-sharing risk by sending the same user question to multiple external providers, increasing exposure surface and making accidental leakage more likely. In this gateway context, the skill is specifically designed to fan out requests across many vendors, so undisclosed multi-provider transmission is more dangerous than a single-provider send.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: When failover is enabled, the same prompt and conversation payload may be sent to multiple third-party model providers until one succeeds. In an agent gateway handling potentially sensitive source code, secrets, or enterprise data, this increases data exposure and can violate user expectations, consent boundaries, or provider-specific data handling requirements if not clearly disclosed and controlled.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The streaming path can retry across providers, meaning partially transmitted user input may already have been disclosed to one provider before the router sends the same request to another. In a unified LLM gateway, this creates additional privacy and compliance risk because users may assume a single selected backend receives their data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This server forwards user-supplied text, images, audio, and video to third-party model providers, yet this file provides no explicit consent gate, data-classification check, or user-facing disclosure at call time. In an agent setting, that can cause unintentional exfiltration of sensitive prompts, local file contents, or media to external services, especially because several parameters explicitly accept file paths, URLs, and base64 data.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: _core/calibrate.py:97