Security audit

Multi-Model Router

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate model-routing skill, but its automatic cloud fallback and broad context access do not match its strong privacy promises.

Review before installing. Use this skill only if you are comfortable with automatic model selection that may route non-sensitive, misclassified, long-context, or failed requests to cloud models. Do not rely on the local-only privacy claim unless cloud fallback is disabled and audit-log retention/access are understood.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill exposes persistent preference storage and audit log retrieval without any visible access control, redaction, or purpose limitation in this entry point. In an agent-skill context, audit logs can contain prompts, routing reasons, model choices, or other sensitive metadata, and writable preferences create a persistence surface that may be abused to alter future routing behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises 'fully automated' routing while also listing cloud-hosted models, but it does not clearly warn users that their prompts may be transmitted to external providers under some conditions. This creates a real privacy and consent risk because users may assume all processing is local or privacy-preserving, especially given the strong safety claims elsewhere in the document.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation contexts are broad and loosely defined, such as triggering when users mention multiple AI models or when privacy-sensitive content is detected. In a skill with memory and workspace file integration enabled, overbroad activation can cause the router to engage unexpectedly and influence model selection or data handling in contexts the user did not clearly request.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation claims privacy-sensitive prompts will use a local model, but elsewhere indicates the router falls back to a cloud model if routing fails. Without an explicit warning, users may submit secrets assuming guaranteed local processing, creating a realistic confidentiality risk during failure paths. In a model-routing skill, this context makes the issue more dangerous because the core feature directly governs where sensitive data is sent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The routing path can send prompts and context to a cloud model through this.router.route(...) while the call site provides no explicit warning, consent check, or privacy gate. Because prompts and context may contain sensitive user or system data, silent transmission to a remote provider creates a confidentiality risk.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The fallback/default configuration prefers the cloud model `xinliu/qwen3-max` (`fallback_strategy: "high_context"`) even when user preferences are absent, which means remote processing is the default behavior rather than an explicit choice. In a routing skill that handles arbitrary prompts and context, this increases the chance that privacy-sensitive data is sent off-box unintentionally.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The logger persists routing decision metadata to disk, including free-form fields like reason and classification outputs such as privacyLevel and taskType, without any evidence of minimization, redaction, retention controls, or user disclosure. In an agent skill context, these values can indirectly contain sensitive prompt or workflow information, creating a privacy and information exposure risk if logs are accessed by other users, processes, backups, or support tooling.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.