T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/semantic_router.py:29- Finding
Predictable Shared Cache Permits Local Route Poisoning
- Content
View full analysis
- Remediation
View remediation
Security audit
ChromaDB Agent Router
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local semantic routing skill with some deployment hardening issues but no artifact-backed evidence of exfiltration, deception, or destructive behavior.
Reasonable to install for local routing if you trust the Python dependency chain. For shared or security-sensitive systems, use a private cache directory, clear or rebuild the ChromaDB cache when routes change, pin dependencies, and avoid sending sensitive messages through the API until cache and model provenance are controlled.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:7- Finding
Unpinned Executable Dependencies and Implicit Model Retrieval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python3 scripts/router-api.py --port 8321
Route a message
curl -X POST http://localhost:8321/route
-H "Content-Type: application/json"
-d '{"message": "Check the firewall logs for suspicious activity"}'text
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The top-level docstring presents action-verb scoring as part of the router's configurable behavior, and the example routes include per-route 'action_verbs' fields. In practice, _detect_action_verbs uses only fixed internal lists and never reads the configured action_verbs values, so the documented intent diverges from the implemented behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The documentation highlights that the router understands French/English bilingual queries and later describes mandatory French normalization in the processing pipeline. Because the skill presents this language behavior as built-in rather than user-selectable or explicitly scoped to a bilingual environment, it may impose locale-specific behavior without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The documentation explicitly states that embeddings persist in
/tmp/semantic_router_cache/, but it does not warn users that routed content or derived representations may be written to disk. In a message-routing skill, users may submit sensitive operational or security-related prompts, so undocumented local persistence creates a privacy and data-handling risk even without any external exfiltration.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
These notes describe language handling in a way that centers English and treats French as a secondary normalization case, but they do not mention any user opt-in, language selection, or explicit justification for this locale constraint. Because SQP-3 applies to natural-language policy issues in any file type, this is a mild language-policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The module docstring advertises a "41-message bilingual benchmark," and the implementation specifically normalizes French text and hard-codes English/French verb lists. This suggests the skill is designed around a fixed language set but does not clearly disclose language limitations or offer user choice, which can be a natural-language locale policy concern.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest frames this as a fully local semantic router, and the code comments reinforce that no external model is needed. However, the actual semantic capability is delegated to ChromaDB's built-in embedding mechanism, which is an undeclared dependency on an external model package/runtime rather than logic implemented in this skill itself. This is a mild description mismatch because the router is still local, but the claimed implementation simplicity/scope is overstated.
- Content
Static analysis
No suspicious patterns detected.