ClawHub
Back to skill

Security audit

Model Router

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent model-routing guide, but it broadly encourages automatic delegation of user tasks to external model providers without clear privacy checks or consent gates.

Review before installing in environments with private documents, code, calendar data, logs, or regulated data. Use it only with explicit provider allowlists, user confirmation before external delegation, and redaction rules for secrets and sensitive content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# Simple task — Tier 1
sessions_spawn --task "What's on my calendar today?" --model gemini-2.0-flash

# Moderate task — Tier 2
sessions_spawn --task "Summarize this document" --model claude-haiku-4-5
Confidence
98% confidence
Finding
This example explicitly directs the agent to send a calendar-related task to an external model provider. Even though it is presented as documentation, it normalizes third-party delegation of potentially sensitive personal data without requiring consent, minimization, or provider trust checks.

External Model or Provider Selection

High
Category
Excessive Agency
Content
sessions_spawn --task "What's on my calendar today?" --model gemini-2.0-flash

# Moderate task — Tier 2
sessions_spawn --task "Summarize this document" --model claude-haiku-4-5

# Complex task — Tier 3
sessions_spawn --task "Build a React auth component with tests" --model claude-sonnet-4-5
Confidence
98% confidence
Finding
This instruction routes document summarization to a named external model, which can transmit full document contents to a third party. If the document contains confidential, regulated, or proprietary information, the skill's cost-first policy increases the likelihood of unauthorized disclosure.

External Model or Provider Selection

High
Category
Excessive Agency
Content
sessions_spawn --task "Summarize this document" --model claude-haiku-4-5

# Complex task — Tier 3
sessions_spawn --task "Build a React auth component with tests" --model claude-sonnet-4-5

# Reasoning task — Tier 4
sessions_spawn --task "Prove this algorithm is O(n log n)" --model claude-opus-4-6
Confidence
98% confidence
Finding
This example sends code-generation work to an external provider and may include source code, architecture context, or internal business logic. In enterprise settings, forwarding code and surrounding prompts to third-party models can expose intellectual property, secrets, or security-sensitive implementation details.

External Model or Provider Selection

High
Category
Excessive Agency
Content
sessions_spawn --task "Build a React auth component with tests" --model claude-sonnet-4-5

# Reasoning task — Tier 4
sessions_spawn --task "Prove this algorithm is O(n log n)" --model claude-opus-4-6
```

## Progressive Escalation Pattern
Confidence
96% confidence
Finding
This example routes formal reasoning tasks to a premium external model; by itself that is not dangerous, but it reinforces automated external delegation without privacy gating. The risk depends on the content of the reasoning task, which could include confidential algorithms, research, or internal data.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# 1. Try Tier 1 with timeout
sessions_spawn --task "Fix this bug" --model gemini-2.0-flash --runTimeoutSeconds 60

# 2. If output is poor or times out, escalate to Tier 2
sessions_spawn --task "Fix this bug" --model claude-haiku-4-5
Confidence
98% confidence
Finding
This escalation pattern begins by sending bug-fix requests to an external provider, which commonly involves stack traces, logs, code snippets, and environment details. Those artifacts frequently contain secrets, internal paths, tokens, or sensitive operational metadata, so automatic delegation materially increases disclosure risk.

External Model or Provider Selection

High
Category
Excessive Agency
Content
sessions_spawn --task "Fix this bug" --model gemini-2.0-flash --runTimeoutSeconds 60

# 2. If output is poor or times out, escalate to Tier 2
sessions_spawn --task "Fix this bug" --model claude-haiku-4-5

# 3. If still failing, escalate to Tier 3
sessions_spawn --task "Fix this complex bug" --model claude-sonnet-4-5
Confidence
98% confidence
Finding
This second escalation step continues transmitting the same debugging task to another external provider, multiplying the exposure surface across vendors. Repeated escalation can spread the same sensitive material to multiple third parties without any additional user approval or disclosure.

External Model or Provider Selection

High
Category
Excessive Agency
Content
sessions_spawn --task "Fix this bug" --model claude-haiku-4-5

# 3. If still failing, escalate to Tier 3
sessions_spawn --task "Fix this complex bug" --model claude-sonnet-4-5
```

Maximum escalation chain: 3 attempts. If Tier 3 fails, surface the error to the user rather than burning tokens.
Confidence
98% confidence
Finding
The final escalation step sends a 'complex bug' externally, likely with even more diagnostic context and source material. The skill's 'start cheap and escalate' design makes the privacy problem worse because the same sensitive payload may be propagated multiple times in pursuit of cost/performance tradeoffs.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# Batch summaries in parallel with cheap model
sessions_spawn --task "Summarize doc A" --model gemini-2.0-flash &
sessions_spawn --task "Summarize doc B" --model gemini-2.0-flash &
sessions_spawn --task "Summarize doc C" --model gemini-2.0-flash &
wait
Confidence
97% confidence
Finding
This batch-processing example encourages parallel submission of document summaries to an external model, increasing the volume and speed of data exfiltration if the documents are sensitive. Parallelization amplifies impact because multiple files may be disclosed before a user notices or can intervene.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# Batch summaries in parallel with cheap model
sessions_spawn --task "Summarize doc A" --model gemini-2.0-flash &
sessions_spawn --task "Summarize doc B" --model gemini-2.0-flash &
sessions_spawn --task "Summarize doc C" --model gemini-2.0-flash &
wait
Confidence
97% confidence
Finding
This is another parallel external submission of document content, contributing to the same privacy and data-governance issue. In context, the skill explicitly optimizes for savings, which can pressure the system to prioritize cheap third-party routing over confidentiality controls.

External Model or Provider Selection

High
Category
Excessive Agency
Content
# Batch summaries in parallel with cheap model
sessions_spawn --task "Summarize doc A" --model gemini-2.0-flash &
sessions_spawn --task "Summarize doc B" --model gemini-2.0-flash &
sessions_spawn --task "Summarize doc C" --model gemini-2.0-flash &
wait

# Then analyze results with premium model
Confidence
97% confidence
Finding
This third parallel summary call further demonstrates automated fan-out of content to external providers. The danger is heightened by the cumulative effect: multiple independent disclosures can occur from a single workflow with no mention of consent, approved vendors, or data handling restrictions.

External Model or Provider Selection

High
Category
Excessive Agency
Content
wait

# Then analyze results with premium model
sessions_spawn --task "Synthesize findings from all summaries" --model claude-sonnet-4-5
```

## Special Routing Rules
Confidence
97% confidence
Finding
After externally summarizing multiple documents, this step sends synthesized findings to yet another premium model, potentially compounding disclosure by transmitting derived sensitive content across providers. Cross-provider synthesis broadens the trust boundary and can expose both original substance and aggregate insights.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill advertises broad trigger phrases such as 'which model should I use', 'optimize cost', and 'use the right model', which can match many ordinary conversations and cause the router to activate unexpectedly. Unintended activation is risky here because the skill can influence downstream delegation decisions and encourage sending user tasks to external providers without an explicit decision point.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill repeatedly instructs the agent to use `sessions_spawn` and route work to named third-party models, but it does not clearly require disclosure that task content may be transmitted to external providers. This creates a real privacy and data-governance risk, especially for documents, code, calendar data, debugging traces, or sensitive user content that may be forwarded automatically for cost optimization.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The skill hard-codes a provider-routing rule for Chinese language tasks without user opt-in or disclosure. While not inherently malicious, language-based routing can unexpectedly shift user data to a different vendor or jurisdiction and may conflict with user privacy, compliance, or trust expectations.

Static analysis

No suspicious patterns detected.