Free Model Auditor（免费模型审计员）

• Outcome: Review
• Latest audit: Aug 30, 2026 · 8:55 AM UTC
• Version: 1.6.0

Overview

The skill does what it says, but it automatically uses stored API keys for live provider calls and modifies the user's model registry without a clear user confirmation step.

Install only if you want an active auditor that will contact model providers using API keys stored in models.json and update that registry. Before running it, review the dry-run diff, keep the generated backup, and avoid using it in workspaces where automatic report/log changes or third-party provider calls are not acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly performs sensitive operations—reading environment variables, reading and writing local files, and making outbound network requests—yet it declares no permissions or equivalent capability boundaries. This creates a mismatch between what the user may expect from the metadata and what the skill actually does, reducing transparency and making risky actions easier to trigger without informed consent.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are broad enough to overlap with ordinary maintenance or inspection requests, which increases the chance that the skill activates in contexts where the user did not intend network probing or file modification. Because this skill can perform live tests and update models.json, overbroad routing materially raises the risk of unintended sensitive actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs automatic modification of models.json and creation or overwrite of report/log files without requiring an explicit confirmation immediately before those writes. In context, this is dangerous because the skill edits a configuration registry that affects future model behavior and can also rename or overwrite workspace documents, so an accidental invocation could change user state persistently.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match ordinary user requests about checking models or doing routine audits, which can cause the skill to activate unexpectedly. In this skill's context, accidental activation is more dangerous because the manifest also advertises network probing and automatic modification of models.json, so scope ambiguity can lead to unintended side effects.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The manifest states that the skill will perform VPN connectivity checks, live-test providers, and automatically apply additions/removals to models.json, but it does not present an explicit warning or consent boundary for these impactful actions. This is dangerous because users may invoke what sounds like a benign audit and unknowingly authorize outbound network access and persistent file modifications, increasing the risk of unintended changes, privacy issues, or environmental tampering.

External Transmission

Medium

• Category: Data Exfiltration

Content

python references/test_harness.py probe https://generativelanguage.googleapis.com https://integrate.api.nvidia.com

# 拉取某厂商模型目录
python references/test_harness.py catalog https://api.siliconflow.cn/v1 API_KEY

# 活体实测候选模型（自动读取 HTTPS_PROXY / HTTP_PROXY 环境变量）
python references/test_harness.py test https://api.siliconflow.cn/v1 API_KEY Qwen/Qwen3-8B

• Confidence: 89% confidence
• Finding: The skill sends API keys and model-test requests to external provider endpoints as part of catalog retrieval and live validation. Although this is part of the stated purpose, it still constitutes sensitive external transmission because secrets from models.json are reused across network calls, and broad activation or insufficient confirmation could cause unintended disclosure to third-party services.

Static analysis

No suspicious patterns detected.