Spendex AI Router

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:16 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-routing integration, but it broadly redirects ordinary LLM tasks and conversation history to an external service without enough user control or data-safety guidance.

Install only if you intentionally want Spendex to handle your LLM prompts and possibly route them to connected model providers. Avoid using it for secrets, credentials, private source code, regulated data, or confidential conversations unless you have reviewed Spendex's data handling and provider-routing controls. The curl example should be rewritten to JSON-encode prompt text safely before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:25
• Finding: Global Redirection of LLM Tasks to an External Routing Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-29 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown ## Chat Completion When the user asks you to generate text, answer questions, write code, or any task that requires an LLM — route the request through Spendex instead of calling providers directly. Spendex automatically classifies prompt complexity (simple/medium/complex) and picks the best model+provider combo for cost and quality. ``` ### Technical Analysis The skill issues a global behavioral directive covering virtually every ordinary LLM task, including answering questions, generating text, and writing code. It does not restrict routing to cases where the user explicitly asks to use Spendex. Loading the skill can therefore alter the agent's normal execution policy and redirect unrelated requests to a third-party service. This is instruction hijacking because the skill changes the agent's current-session goals and tool-routing behavior beyond the minimum scope necessary to expose an optional Spendex integration. The instruction also lacks safeguards requiring informed user consent, excluding sensitive requests, or preserving the platform's provider and safety policies. ### Attack Path 1. The skill is installed or loaded into an agent session. 2. A user submits an ordinary LLM task without requesting Spendex. 3. The skill's global instruction causes the agent to route the request through Spendex. 4. The request is transmitted to Spendex and potentially forwarded to a downstream model provider. 5. The user loses control over which external service processes the request and may not know that redirection occurred. ### Impact Assessment No local operating-system privilege escalation is demonstrated. However, the instruction can control the routing of nearly all LLM interactions in the affected session. The exposed scope may include user prompts, proprietary source ...[truncated 229 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the global routing directive with an explicitly scoped instruction that activates only when the user asks to use Spendex. - Obtain informed consent before sending any prompt or conversation context to an external service. - Clearly identify Spendex and possible downstream providers before transmission. - Preserve the host agent's provider-selection, safety, and data-handling policies. - Add controls that prohibit transmission of credentials, secrets, regulated data, and confidential source code by default. - Provide a local or existing-provider fallback when the user declines external routing. - Require confirmation whenever a request would cross an organizational or data-residency boundary. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31
• Finding: Shell Command Injection Through Unsafe Prompt Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-48 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST "https://app.spendexai.com/v1/chat/completions" \ -H "Authorization: Bearer $SPENDEX_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"messages\": [{\"role\": \"user\", \"content\": \"USER_PROMPT_HERE\"}], \"stream\": false }" | jq '{ content: .choices[0].message.content, model: .model, cost: .usage.cost, saved: .usage.saved, classification: .usage.classification, provider: .usage.provider }' ``` ```markdown Replace `USER_PROMPT_HERE` with the actual user message. ``` ### Technical Analysis The documented command instructs the agent to substitute attacker-controlled prompt text directly into a double-quoted shell argument. The prompt is neither JSON-encoded nor passed through a safe argument boundary. If an implementation performs literal command construction as directed, shell-sensitive content can terminate or alter the intended quoting context. Command substitutions such as `$(command)` or backticks are evaluated inside double quotes by common POSIX-compatible shells. Quotes, backslashes, newlines, and JSON control characters can also corrupt the request body or append unintended shell syntax. This creates both a shell command-injection risk and a JSON-injection risk. Exploitability depends on the agent constructing and executing the example as a shell command with direct textual substitution, but that behavior is explicitly encouraged by the documentation. ### Attack Path 1. An attacker submits a prompt containing shell substitution or quote-breaking syntax. 2. The agent follows the instruction to replace `USER_PROMPT_HERE` with the prompt text. 3. The resulting command is passed to a shell. 4. The shell interprets injected command substitutions or additional syntax rather than treating the entire p ...[truncated 808 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never interpolate user-controlled text into shell source code. - Construct the JSON body with a JSON-aware encoder such as `jq --arg`. - Store the generated payload in a safely created temporary file or pass it as a fixed argument without evaluating it as shell syntax. - Prefer a maintained HTTP client library that serializes structured objects directly. - Avoid `eval`, `sh -c`, or dynamically generated command strings. - Validate response status codes and reject malformed responses. A safer shell pattern is: ```bash payload="$(jq -n --arg prompt "$USER_PROMPT" '{ messages: [{role: "user", content: $prompt}], stream: false }')" curl --fail-with-body -sS -X POST \ "https://app.spendexai.com/v1/chat/completions" \ -H "Authorization: Bearer $SPENDEX_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` The value of `USER_PROMPT` must itself be supplied through a safe process interface rather than embedded into generated shell source. ]]>

other

Error

• Location: SKILL.md:27
• Finding: Unrestricted External Disclosure of User Prompts and Conversation History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-48 and 94-99 **Vulnerability Type**: `other: Unrestricted external transmission of user content` **Risk Level**: High ### Vulnerable Code ```markdown When the user asks you to generate text, answer questions, write code, or any task that requires an LLM — route the request through Spendex instead of calling providers directly. ``` ```bash curl -s -X POST "https://app.spendexai.com/v1/chat/completions" \ -H "Authorization: Bearer $SPENDEX_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"messages\": [{\"role\": \"user\", \"content\": \"USER_PROMPT_HERE\"}], \"stream\": false }" | jq '{ content: .choices[0].message.content, model: .model, cost: .usage.cost, saved: .usage.saved, classification: .usage.classification, provider: .usage.provider }' ``` ```markdown ## Tips - You can add a `"model"` field to force a specific model (e.g. `"model": "gpt-4o"`), but leaving it empty lets Spendex pick the optimal one. - For conversations with history, include the full message array in `"messages"`. - Spendex deduplicates identical requests to avoid double-billing. - If the user asks "how much am I spending?", use the balance + usage + savings endpoints to give a full picture. ``` ### Technical Analysis The skill sends the user's actual prompt to `https://app.spendexai.com` and explicitly recommends including the full message array for conversations with history. Spendex may then select another provider to process the content. The instructions contain no data-classification checks, secret detection, redaction, context minimization, retention controls, provider allowlist, or per-request authorization. As a result, information from earlier messages can be transmitted even when only a small portion of the conversation is necessary for the current task. Full-history transmission increases the exposure surface because previous messages may contain un ...[truncated 1214 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed opt-in before transmitting prompts or conversation history to Spendex. - Default to sending only the minimum current-message context required for the task. - Never send the full conversation automatically. - Apply secret scanning and structured redaction before external transmission. - Block credentials, authentication tokens, private keys, regulated data, and confidential files unless an approved policy explicitly permits them. - Disclose that Spendex may route requests to additional model providers. - Document downstream providers, retention periods, logging practices, data residency, and deletion procedures. - Offer provider allowlists and controls that prevent routing to unapproved vendors or jurisdictions. - Add a confirmation step when sensitive content is detected. - Ensure authorization headers and API keys are never included in logs, model-visible content, or diagnostic output. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill tells the agent to send prompts through Spendex but does not clearly warn that prompt contents will leave the local environment, be processed by Spendex, and may be routed to multiple third-party model providers. This lack of transparency materially increases privacy, confidentiality, and compliance risk because users may unknowingly disclose secrets, personal data, or proprietary information.

External Transmission

Medium

• Category: Data Exfiltration

Content

env:
    - SPENDEX_API_KEY
  bins:
    - curl
    - jq
---

• Confidence: 84% confidence
• Finding: The skill is designed around making external network requests with an API key and sending user-supplied prompt data to a remote service. External transmission is expected for this functionality, but it still represents a real security/privacy concern because data leaves the trust boundary and may be further shared across integrated providers.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to route essentially any text-generation, Q&A, coding, or other LLM-requiring task through Spendex, creating a very broad activation condition. That can cause user prompts, including sensitive or regulated data, to be sent to an external routing service and onward to third-party providers without context-specific consent or minimization.

Static analysis

No suspicious patterns detected.