T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:25- Finding
Global Redirection of LLM Tasks to an External Routing Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Spendex AI Router
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed AI-routing integration, but it broadly redirects ordinary LLM tasks and conversation history to an external service without enough user control or data-safety guidance.
Install only if you intentionally want Spendex to handle your LLM prompts and possibly route them to connected model providers. Avoid using it for secrets, credentials, private source code, regulated data, or confidential conversations unless you have reviewed Spendex's data handling and provider-routing controls. The curl example should be rewritten to JSON-encode prompt text safely before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:31- Finding
Shell Command Injection Through Unsafe Prompt Interpolation
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
SKILL.md:27- Finding
Unrestricted External Disclosure of User Prompts and Conversation History
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to send prompts through Spendex but does not clearly warn that prompt contents will leave the local environment, be processed by Spendex, and may be routed to multiple third-party model providers. This lack of transparency materially increases privacy, confidentiality, and compliance risk because users may unknowingly disclose secrets, personal data, or proprietary information.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill is designed around making external network requests with an API key and sending user-supplied prompt data to a remote service. External transmission is expected for this functionality, but it still represents a real security/privacy concern because data leaves the trust boundary and may be further shared across integrated providers.
- Content
md env: - SPENDEX_API_KEY bins: - curl - jq ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to route essentially any text-generation, Q&A, coding, or other LLM-requiring task through Spendex, creating a very broad activation condition. That can cause user prompts, including sensitive or regulated data, to be sent to an external routing service and onward to third-party providers without context-specific consent or minimization.
- Content