Auto Model Router

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:15 AM UTC
• Version: 0.1.1

Overview

This skill is a broad automatic model router that is mostly purpose-aligned, but it takes over ordinary tasks and uses unsafe command templates with user text.

Review this carefully before installing. It is intended to route tasks to other AI models, but it is written to activate for nearly all substantive requests and may send prompt text to configured providers or a user-configured router. It should be narrowed to explicit invocation or clear opt-in, and its referenced scripts should be included and use safe argument handling before broad use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:4
• Finding: Global Skill Activation Hijacks Unrelated Agent Tasks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4-7` **Vulnerability Type**: Global instruction and task-routing hijacking **Risk Level**: High ### Vulnerable Code ```yaml description: > Automatically select and use the best AI model for any task based on task type. ALWAYS activate this skill at the start of a new task or when the user asks a substantive question. ``` Related mandatory behavior appears at `SKILL.md:68` and `SKILL.md:102-105`: ```markdown For every substantive task, follow this procedure. ``` ```markdown **Step 3 — Present the result** Show the response naturally. Add a subtle footer: `_[auto-model-router: used {category} → {model}]_` ``` ### Technical Analysis The skill directs the agent to activate it for almost every substantive request rather than only when the user explicitly asks for model routing. Once activated, it replaces the agent's normal task-handling process with a workflow that classifies the request, forwards it to another model or router, presents the returned content, and adds mandatory branding. This is session-level instruction hijacking because loading the skill changes the agent's behavior for unrelated tasks. The trigger scope is effectively global due to phrases such as “ALWAYS activate” and “every substantive task.” The behavior also creates a confidentiality concern: ordinary task content can enter the routing workflow even when the user did not specifically request model routing. Although the document states that the selected provider or user-configured router receives the text, automatic activation reduces the opportunity for task-specific informed consent. ### Attack Path 1. The skill is installed or made available to an agent. 2. A user submits any substantive request, including a request unrelated to model routing. 3. The broad activation instruction causes the agent to load and follow the skill. 4. The agent redirects the request through the skill's provider or router workflow. 5 ...[truncated 704 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the global activation directives, including “ALWAYS activate” and “every substantive task.” 2. Restrict activation to explicit invocations such as `/auto-model-router` or an unambiguous user request to select another model. 3. Before transmitting task content, identify the destination provider or router and obtain explicit user consent. 4. Do not replace ordinary task execution unless the user has requested routing for that specific task. 5. Remove the mandatory footer or make it an opt-in informational feature. 6. Define narrow trigger phrases that specifically refer to model selection rather than generic words such as “help,” “write,” or “explain.” 7. Ensure higher-priority agent safety and privacy instructions always take precedence over skill instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:92
• Finding: Untrusted Prompt Content Is Interpolated into Shell Command Templates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:92-95` **Vulnerability Type**: OS command injection through unsafe shell interpolation **Risk Level**: High ### Vulnerable Code ```markdown **Step 2 — Call the model** ``` python3 ~/.claude/skills/auto-model-router/scripts/call_model.py "<category>" "<user task text>" ``` ``` The same unsafe pattern is repeated at `SKILL.md:119-122`: ```markdown **Step 1 — Get recommendation** ``` python3 ~/.claude/skills/auto-model-router/scripts/recommend.py "<user task text>" "<USER_ID>" ``` ``` Route-changing parameters are also inserted without quoting at `SKILL.md:157-160`: ```markdown When the user says things like "switch to GPT-4o for translation" or "use DeepSeek for coding": ``` python3 ~/.claude/skills/auto-model-router/scripts/update_route.py <category> <provider> <model> ``` ``` ### Technical Analysis The documented commands place attacker-controlled task text and route values directly into command strings. Quoting the task text with double quotes is insufficient when the command is interpreted by a shell: constructs such as `$(command)` and backtick command substitution remain active inside double quotes. The category, provider, and model parameters used by `update_route.py` are not quoted at all, additionally permitting whitespace and shell metacharacter injection. For example, task text containing `$(id)` would cause the shell to execute `id` before invoking the Python script if the agent constructs and runs the documented command through a shell. More destructive commands could read files, change configuration, or launch additional processes. The project contains only `SKILL.md`; the referenced Python scripts are absent. Consequently, the scripts' own argument handling cannot be audited, and no script-level mitigation can be verified. The vulnerability is in the documented command-construction procedure itself and is exploitable when an implementing agent executes it through a shell. ...[truncated 1494 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings by interpolating task text or user-controlled route values. 2. Invoke Python using a structured argument array with shell processing disabled, for example: ```python subprocess.run( ["python3", script_path, category, user_task], shell=False, check=True, ) ``` 3. Prefer passing long or untrusted task content through standard input or a safely serialized data format rather than a command-line argument. 4. Validate `category`, `provider`, and `model` against strict allowlists before invocation. 5. Reject values containing unexpected control characters, separators, or shell metacharacters as defense in depth. 6. Resolve and validate script paths rather than relying on shell expansion of `~`. 7. Document explicitly that implementations must not use `shell=True`, `os.system`, or equivalent shell-based execution. 8. Include the referenced scripts in the audited package so their input validation, credential handling, network behavior, and subprocess usage can be independently reviewed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger phrases are extremely broad and match routine language such as 'help me', 'write', 'analyze', and 'explain', which can cause this skill to activate on a large fraction of normal user requests. Because the skill can then route user task text to external model providers or a configured router, over-triggering increases the chance of unnecessary data exposure, unexpected execution paths, and user loss of control over when the skill is used.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The instruction to 'ALWAYS activate this skill at the start of a new task or when the user asks a substantive question' forces use without user opt-in and bypasses the principle of least surprise. In this skill, automatic activation is more dangerous because Mode A sends task text to a provider and Mode B may send task text plus a session identifier to a router service, so users may have their prompts processed externally even when they did not intentionally invoke routing.

Static analysis

No suspicious patterns detected.