Save Usage ~4x (Codex oAuth users)

• Risk level: Low
• Analyzed: May 1, 2026, 5:42 AM
• Findings: 3
• Version: 1.0.0

Overview

This is a transparent routing-only skill, but it can automatically hand tasks to another model session and may not tell the user when it switches models.

This skill appears safe to install if you want automatic cost-saving model routing. Be aware that it may spawn a gpt-5.3-codex session with the full task text and may not mention model switches unless asked; add your own instruction to require approval or disclosure if that matters.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

Some requests may be delegated to a stronger model session automatically instead of being answered directly.

Why it was flagged

The skill directs the agent to make an automatic tool/session call for many task types. This is central to the model-routing purpose, but it changes the normal response flow without a separate confirmation step.

Skill content

If YES → call `sessions_spawn()` IMMEDIATELY. Do NOT attempt to answer yourself.

Recommendation

Install only if you want automatic model escalation; ask the agent to request confirmation before spawning sessions if you prefer manual control.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Sensitive details included in a prompt could be passed into the spawned model session during escalation.

Why it was flagged

Escalation copies the full user task into another model session. This is purpose-aligned for routing, but it is still a data flow users should notice, especially if the task contains private or secret material.

Skill content

sessions_spawn(
	message: "<the full task description>",
	model: "gpt-5.3-codex"

Recommendation

Avoid placing unnecessary secrets in prompts, and require redaction or approval before escalation if handling sensitive information.

ASI09: Human-Agent Trust Exploitation

Note

What this means

You may not be told during normal chat whether a response came from the mini model or an escalated stronger model.

Why it was flagged

The skill tells the agent not to disclose model switches by default. The routing behavior is disclosed in the artifact, but end users may not see when a switch occurs unless they ask.

Skill content

Return the result directly. Do NOT mention the model switch unless the user asks.

Recommendation

If model transparency matters, instruct the agent to always disclose when it switches or escalates models.