Neo Smart Router

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:43 PM UTC
• Version: 1.3.0

Overview

This skill appears to be a local text-routing helper with disclosed local metadata logging and no evidence of network upload, credential access, or deceptive behavior.

Before installing, understand that the skill writes local routing logs containing timestamps, text length, inferred tags, chosen route, and processing time. It does not appear to store raw text or upload data, but users who are sensitive to behavioral metadata should review or clear the local logs periodically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file title and all operational guidance are written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only region or compliance context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly states that routing logs are used to analyze user habits and improve routing accuracy, but it does not present a clear, user-facing notice about what metadata is retained, how long it is stored, or how users can opt out. Even if raw text is not stored, behavioral metadata such as timestamps, input length, and inferred categories can still reveal sensitive usage patterns and create privacy risk.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown file presents all user-facing instructions, status updates, and examples exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The added English triggers for versionA include very common phrases and sentiment words such as 'I feel', 'I think', 'why', 'sad', and 'happy'. Because these occur frequently in ordinary conversation, they can cause unintended routing into a specific mode, which weakens routing integrity and may expose users to the wrong processing path or retention behavior.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The structural-mode English words like 'summary', 'data', 'analysis', and 'report' are generic terms that appear in many non-structured prompts. Without stronger activation constraints, an attacker or normal user can easily steer content into structure mode by sprinkling common tokens, leading to misclassification and potentially inappropriate handling of the content.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The knowledge-mode triggers include highly generic English terms such as 'system', 'concept', 'knowledge', and 'theory', which can appear in a broad range of harmless or unrelated text. This makes it easy to trigger deep-preservation routing unintentionally or adversarially, increasing the chance of over-retention, wrong processing mode, or bypass of more suitable routing paths.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The configuration explicitly limits supported languages to "zh" and "en" and states mixed-language handling is automatic, but the document does not present this as a user choice or clearly justify the locale restriction. Under the policy, language constraints should either be opt-in or clearly documented as justified.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The skill’s user-facing descriptions, report text, usage message, and naming are consistently Chinese-only, which implies a fixed language/locale behavior. There is no indication that the user can choose another language or that the locale restriction is intentional and documented for a region-specific use case.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This JSON file defines activation-style keyword lists using very broad everyday phrases such as "why", "how to", "I think", and common emotion words like "happy" and "sad". Because the file provides no explicit trigger constraints, exclusions, or negative examples, these terms could overlap heavily with normal conversation and cause unintended routing or invocation.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The structureWords list includes generic terms like "data", "analysis", "report", "list", "first", and "second", which commonly appear in ordinary text outside the intended skill scope. The file does not specify thresholding, required combinations, or cases where these words should not trigger classification, making the activation boundary ambiguous.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The configuration explicitly limits supportedLanguages to "zh" and "en" while enabling automatic mixed-language handling, but provides no user opt-in, language selection mechanism, or justification for excluding other locales. This can constitute a language/locale policy issue because the restriction is embedded in natural-language-facing behavior without documented choice.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This markdown file consistently uses Chinese for headings, labels, explanations, and conclusions, but does not indicate that the skill is region-specific or that users may choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The top-level documentation frames the module as a "Smart Router" that analyzes input text features and selects an optimal compression version. However, routeCompression also calls logRoute, which creates a logs directory and appends log entries to a file, introducing filesystem side effects not reflected in the documented intent.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The code persistently logs input-derived metadata to local files without any notice, opt-in, retention controls, or sanitization. In an agent skill context, even metadata like message length, tags, timing, and chosen route can reveal user behavior patterns or sensitive content classes, creating an avoidable privacy leak if logs are exposed or retained too broadly.