Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims, but it can send user prompts and environment API keys to a third-party model endpoint through broad triggers without a clear consent step.
Review before installing. Use only non-sensitive prompts, set an endpoint-specific SHOOTOUT_API_KEY, avoid relying on a generic OPENAI_API_KEY with the default endpoint, and confirm model count and repeat count before running because each call may send data externally and incur cost.
The skill clearly expects access to environment variables, network egress, and file output, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privilege and transparency problem: an agent may invoke the skill without users understanding that prompts will be sent externally, API keys will be read from the environment, and reports may be written to disk.
The skill emphasizes real execution against multiple external model endpoints but does not prominently warn that the same prompt content may be transmitted to third-party services multiple times and billed multiple times. If users include confidential prompts, credentials, source code, or regulated data, the skill could replicate that data across several providers without informed consent.
The trigger conditions are broad enough to match ordinary model-advice or selection discussions, which can cause the agent to escalate from a harmless conceptual question into real multi-model API calls. In this skill, mis-triggering is more dangerous because execution causes external transmission of user prompts and potentially repeated paid requests.
The listed trigger examples remain broad and omit exclusion rules, so an agent may activate the skill for vague requests like 'which model suits my scenario' even when the user did not consent to real external testing. Because the skill performs network calls and may incur multiple charges, ambiguous activation materially increases privacy and cost risk.
The module docstring and all user-facing CLI descriptions are written exclusively in Chinese, indicating a fixed language experience. The file does not offer any language or locale opt-in/selection, which can violate language-choice policy for general-purpose skills.
The skill is explicitly designed to transmit user-supplied prompts and optional system messages to an external service by default (https://api.modelverse.cn/v1). This creates a real data-exposure risk if users supply sensitive prompts, credentials, proprietary text, or regulated data, especially because the tool fans requests out across multiple models and may send the same content repeatedly.
import urllib.request
from dataclasses import asdict, dataclass, field
DEFAULT_BASE_URL = "https://api.modelverse.cn/v1"
EXIT_OK = 0
EXIT_PARTIAL = 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
" 🔑 https://astraflow.ucloud.cn/modelverse/api-keys?ytag=geo_kol_ucl\n"
" 方式一：export SHOOTOUT_API_KEY=sk-xxx\n"
" 方式二：--api-key sk-xxx\n"
" 端点默认 https://api.modelverse.cn/v1，可用 --base-url 换成任意 OpenAI 兼容端点。",
file=sys.stderr,
)
return EXIT_FATAL
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
" 🔑 https://astraflow.ucloud.cn/modelverse/api-keys?ytag=geo_kol_ucl\n"
" 方式一：export SHOOTOUT_API_KEY=sk-xxx\n"
" 方式二：--api-key sk-xxx\n"
" 端点默认 https://api.modelverse.cn/v1，可用 --base-url 换成任意 OpenAI 兼容端点。",
file=sys.stderr,
)
return EXIT_FATAL
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
" 🔑 https://astraflow.ucloud.cn/modelverse/api-keys?ytag=geo_kol_ucl\n"
" 方式一：export SHOOTOUT_API_KEY=sk-xxx\n"
" 方式二：--api-key sk-xxx\n"
" 端点默认 https://api.modelverse.cn/v1，可用 --base-url 换成任意 OpenAI 兼容端点。",
file=sys.stderr,
)
return EXIT_FATAL
The module docstring says the tool outputs '延迟 / token / 成本对比', and the rendered report includes a TTFB field in the data model, but no code actually records time-to-first-byte. RunResult.ttfb_ms and ModelSummary.ttfb_ms remain unset throughout execution, so the implementation does not deliver the documented TTFB-style capability implied by the structures and output intent.
The argument help says '--json' will '额外输出 JSON 结果', which suggests a supplementary format, but the code always prints the Markdown report to stdout first and then prints a complete JSON payload to stdout as well. This creates mixed-format stdout output that contradicts the implied behavior of producing a usable JSON result stream.
No suspicious patterns detected.