Security audit
Security checks for vulnerabilities and agentic risk
This skill may be useful for model fallback, but it installs and runs an external gateway that can handle prompts and API keys while also trying to change the agent's broader behavior.
Install only if you are comfortable running a locally started third-party gateway that can see fallback prompts and provider API keys. Use disposable or tightly limited provider keys, avoid confidential workloads unless each provider and the gateway are reviewed, and treat the global SOUL behavior instructions as overbroad for a fallback utility.
SKILL.md:17Global Agent Behavior and Output Hijacking
scripts/setup.sh:8Unverified Third-Party Code and Dependencies Are Downloaded and Executed
scripts/setup.sh:70Sensitive API Credentials and Model Traffic Are Entrusted to an Externally Sourced Gateway
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
echo " pkill -f 'node.*free-way' || lsof -ti:$FREE_WAY_PORT | xargs kill"
echo ""
echo "🗑️ To UNINSTALL:"
echo " pkill -f 'node.*free-way'; rm -rf $FREE_WAY_DIR"
echo ""
echo "🔍 To CHECK status:"
echo " curl http://localhost:$FREE_WAY_PORT/health"
The README markets automatic fallback as 'invisible' and 'zero detection' while requests may be rerouted to free third-party LLM providers with separate privacy and retention policies. This framing minimizes the security and privacy consequences of silently changing processors for potentially sensitive prompts, increasing the risk of undisclosed data sharing and compliance violations.
The skill description explicitly promotes seamless operating changes 'so no one notices,' which is risky because it encourages concealment of backend model/provider substitutions from users and administrators. In this context, hidden switching can bypass expectations about model behavior, safety controls, data handling, and contractual/privacy commitments.
The README presents conflicting claims: elsewhere the skill promises an invisible switchover that users will not notice, while this section says failover is never hidden. In a security-sensitive routing skill, contradictory disclosure language can mislead operators about whether model/provider changes are surfaced to end users and whether data may be sent to different third parties without clear notice.
The entire skill description is written only in German, and there is no indication that users can choose another language or that the skill is intentionally limited to a German-speaking context. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.
Ce fichier de description est entièrement rédigé en français et ne propose aucune alternative linguistique ni indication que la langue est optionnelle. Selon la règle de politique linguistique, forcer une langue spécifique sans choix utilisateur explicite constitue une violation de politique en langage naturel.
The README makes conflicting trust claims: elsewhere the skill is marketed as an 'undetectable takeover' where 'no one notices', while this section says failover is never hidden and is transparent. In a failover/proxy skill that routes prompts to multiple third-party LLM providers, contradictory disclosure language can mislead operators about whether model/provider switching is visible to end users and whether sensitive data may be sent to different vendors without clear notice.
The README promotes 'invisible' or 'undetectable' failover where 'users do not notice' provider switching, which normalizes concealing material backend changes from end users. In a security context this is dangerous because the substitute provider may differ in privacy protections, compliance posture, output quality, or safety behavior, yet the user is intentionally not informed when the switch occurs.
The README initially markets seamless failover to 13+ free LLM providers, but the privacy/data-sharing warning appears only later rather than before installation or first mention of fallback routing. That sequencing can lead users to enable the skill without understanding that prompts and potentially sensitive data may be sent to third-party providers with different retention and privacy policies.
The README explicitly markets failover as 'invisible takeover' and says users 'won't even notice the switch,' which encourages silent substitution of model providers without user awareness at the moment of use. In an agent skill that may route prompts and data to multiple third-party providers, this undermines informed consent, complicates compliance and auditing, and can expose sensitive data to different retention and privacy regimes than users expect.
The README claims 'Full Transparency' and 'never hides the switch,' but this directly conflicts with earlier claims of 'Zero detection' and that users 'won't even notice the switch.' That inconsistency is dangerous because operators may deploy the skill believing it is transparent while the marketing and expected behavior normalize covert provider switching, increasing the risk of misleading users and mishandling data across unexpected third parties.
The README markets failover as seamless and emphasizes 'zero downtime' and 'same personality,' which can encourage operators to route prompts and potentially sensitive data to multiple third-party free LLM providers without fully appreciating the privacy and compliance consequences. Although the document later includes a transparency note, the earlier messaging downplays the operational and data-governance risk of automatic fallback to external providers with differing retention and privacy policies.
Suspicious Unicode normalization or mixed-script content
This file presents the entire skill description and operating guidance exclusively in Russian, with no indication that the user can choose another language or that the skill is intentionally limited to a Russian-speaking region. The policy requires flagging language or locale constraints unless they are optional or clearly justified.
The README markets failover as "undetectable" and "no one notices," while later claiming "full transparency" about provider switching. This inconsistency can mislead operators into deploying the skill without clear user disclosure or data-handling expectations, increasing the risk of unauthorized routing of prompts or sensitive data to third-party free providers.
The README explicitly markets failover as 'invisible' and says users will not notice provider switching, which normalizes non-transparent substitution of the underlying model/provider. Even though a later section mentions transparency, the core sales language encourages concealment and can lead operators to send user data to different third-party providers without clear notice or consent.
The text claims 'no one can distinguish' whether the primary or fallback model is running, encouraging operators to preserve the illusion that the same trusted model is still in use. This is risky because different providers may have different retention, safety, compliance, and output characteristics, so concealing substitution can mislead users and bypass informed consent expectations.
该文件整体仅以简体中文提供技能说明，未见任何提示说明可选择其他语言版本，也未说明该技能仅面向特定中文地区用户。根据规则，未提供用户语言/locale 选择而默认强制单一语言，属于自然语言层面的策略违规。
This markdown file describes configuring fallback so the agent automatically switches to free providers and continues running, which implies user content will be sent to those providers. While later text mentions differing privacy policies, the initial installation/behavior description lacks a prominent upfront warning that fallback can transmit user data to third parties.
The skill instructs users to run a shell setup script, but the manifest declares no explicit tool scope or permissions. That creates an authorization and review gap: consumers and hosting frameworks cannot easily tell that installation/execution of shell commands is required, increasing the chance of unintended code execution from a third-party skill.
The 'user unaware' / '无感接管' messaging promotes silent model and provider substitution specifically designed to avoid notice. In an agent context, this is dangerous because reliability, safety properties, output quality, and data handling may change mid-task while users and operators continue trusting the original model and policies.
The skill markets seamless fallback to free providers but does not clearly warn that prompts, outputs, and possibly sensitive task data may be routed to multiple third-party model providers. Silent routing changes can alter confidentiality, retention, compliance posture, and model behavior without operator awareness.
The skill description promises zero-cost continuity and invisible switching to backup models when a main model fails. In this file, the only zero-token-related content is a session-scoped 'zero token edition' label and a pointer to an external GitHub project; there is no code or logic implementing model failover, model selection, or outage handling.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Start Free-Way in background if not running
if ! curl -s http://localhost:$FREE_WAY_PORT/health &>/dev/null; then
echo "🚀 Starting Free-Way on localhost:$FREE_WAY_PORT..."
nohup npm start > "$FREE_WAY_DIR/free-way.log" 2>&1 &
sleep 3
if curl -s http://localhost:$FREE_WAY_PORT/health &>/dev/null; then
echo "✅ Free-Way running at http://localhost:$FREE_WAY_PORT"
This markdown file contains user-facing instructions only in Spanish, with no parallel language option or opt-in. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale-policy issue unless the restriction is documented and justified.
No suspicious patterns detected.