Security audit

skill-router

Security checks for vulnerabilities and agentic risk

Overview

This skill is an automatic router that can execute and chain other skills broadly, with insufficient scoping and approval boundaries for the authority it describes.

Review this carefully before installing. It is not proven malicious, but it should only be used in an environment where you trust every downstream skill it can route to, can approve or block every side effect, and are comfortable with event/log persistence. Avoid granting it access to credentials, repositories, social accounts, email, or system-recovery tools unless the router is constrained by an external policy layer.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Mandatory Global Routing Hijacks Agent Goals and Automatically Expands Tasks
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:14
Finding: Arbitrary Local Scripts Are Executed After Metadata-Only Inspection
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:91
Finding: Broad Triggers Automatically Initiate State-Changing and External Workflows
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction to use this router on every request gives a powerful orchestration skill universal reach over all user inputs. In context, this is more dangerous because the same file also defines auto-selection, chaining, and direct execution behavior, so broad triggering magnifies the chance of unintended tool invocation and privilege expansion.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The 'review idea and execute' / 'brainstorm and do it now' trigger is especially risky because it combines broad natural-language matching with implied immediate execution. In a federated skill-composition system, this can escalate a casual brainstorming request into autonomous action selection and downstream execution without sufficiently bounded scope or approval.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly documents resolving a matched skill's run field and invoking the referenced shell or JS script with direct execution. In a router that is intended to run first and potentially dispatch across many skills, this creates a broad code-execution surface where any matched skill metadata can lead to execution of local scripts without a strong trust boundary, validation, or sandboxing.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: The auto-execute hook allows subsequent skills to be triggered autonomously after one skill completes, without a mandatory user confirmation boundary. In this router's context, that behavior compounds risk because chained skills may include external communication, code execution, deployment, or recovery actions, turning a single match into a multi-step autonomous workflow.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Subsequent skills consume via events_in

Check hooks → trigger subsequent skills

post: ["skill-a", "skill-b"] → auto-execute

on_error: ["notification-hub"] → notify on error

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Several trigger phrases are generic everyday terms such as "trends," "release," or broad content-creation wording, which can easily match benign conversation. In a router that can chain multiple downstream skills, ambiguous triggers increase accidental activation and can route normal dialogue into analysis, messaging, posting, or deployment workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document claims external actions always require approval, but earlier rules permit automatic notification and even auto-recovery behavior. This inconsistency is dangerous because operators may rely on a safety guarantee that the router does not actually enforce, leading to unreviewed outbound actions or state-changing operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases for the content pipeline are broad consumer-language phrases that could easily appear in ordinary conversation, causing unintended activation of a multi-step workflow that creates content and may progress toward publishing. In the context of a first-gateway auto-router, this increases the chance of accidental skill chaining and execution beyond the user's intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Phrases like 'do market research' are ambiguous and may match benign requests, yet this chain initiates competitor crawling, report generation, and email sending. Because the router is intended for use on every request, an overbroad trigger can cause unintended data collection and outbound actions with limited user awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Generic triggers such as 'market research' and 'industry trends' are likely to overlap with ordinary discussion and can activate a broad data-collection workflow across multiple external sources. In this skill-router context, accidental invocation is more dangerous because it may launch parallel monitoring and scraping tasks automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Trigger phrases like 'release', 'deploy', and 'push to production' are highly generic for a chain that includes commit and push operations. Even with stated safeguards, accidental routing into a deployment-related workflow is dangerous in a gateway skill because it can initiate sensitive code-management actions based on ambiguous user wording.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The chain explicitly persists inter-skill data as JSON files in an events directory without any user-facing disclosure, retention policy, or sensitivity controls. In a router that processes broad user requests, this can silently store prompts, outputs, identifiers, or other sensitive operational data, increasing privacy and leakage risk across chained skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The file uses English-only operational triggers and descriptions, while the signature includes Korean text, suggesting a mixed-locale environment. There is no statement offering users a language choice or clarifying that English-only triggers are required by design.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The phrase "start today" is common conversational language and could unintentionally match ordinary discussion rather than a system-status reporting chain. While a cron schedule is also listed, the natural-language trigger remains underspecified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.