Security audit

Token Decision

Security checks across malware telemetry and agentic risk

Overview

This model-routing skill is functional, but it can automatically send prompts to external model providers, store prompt text locally, and contact an unrelated telemetry service without enough user control.

Install only if you are comfortable with prompts being sent to third-party model providers and snippets being retained locally. Prefer recommendation-only use with --dry-run or --no-exec, avoid secrets or regulated data, and remove or disable the countapi.xyz telemetry before using it in privacy-sensitive environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module presents itself as a local usage statistics panel, but it also makes an outbound network request to fetch global call counts. This mismatch reduces transparency and can surprise users in restricted or privacy-sensitive environments, even though the transmitted data appears limited and the endpoint is hardcoded.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script performs an external HTTP request to a third-party service that is not necessary for computing local database statistics. In a local stats context, unexpected outbound connectivity can leak usage metadata such as IP address, execution timing, and environment-level network access to an external party.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The module is presented as a token-evaluation/recommendation tool, but the CLI path also executes the supplied prompt against third-party model APIs. This mismatch is security-relevant because users may provide sensitive prompts expecting local analysis only, while the code can transmit that content externally and incur charges.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill performs outbound telemetry to a third-party analytics service each time usage is logged, which is unrelated to the core recommendation function and is not transparently disclosed in the code path. Even though only a counter is sent, this creates unexpected network behavior, dependency on an external service, and a privacy/compliance issue in environments where undeclared telemetry is prohibited.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill declares broad automatic trigger phrases such as '推荐模型', '最便宜', and '对比' that are common in normal conversation, making accidental invocation likely. Because the skill can proceed to recommend and directly execute model API calls, an ordinary chat about pricing or model quality could unintentionally send user content into an automated decision and execution flow.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The description explicitly says the skill will 'directly execute' after recommending a model, but it does not warn users that their prompt may be transmitted to external model APIs. This creates a material data exposure risk, especially if users include sensitive business, personal, or regulated information while expecting a local recommendation only.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Automatic failover means the same user prompt may be retried with alternate models or providers after an API failure, but the skill does not disclose this behavior. That increases the privacy and compliance risk because data can be replicated across multiple external services without the user's knowledge or approval.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script processes historical user prompts from a local SQLite log and prints derived analysis without any notice, consent flow, or minimization controls. If those prompts contain sensitive or personal data, this can expose private information to anyone who runs the tool or views its output, especially in shared environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code makes a network request without any warning, prompt, or disclosure to the user. Silent external communication is risky in enterprise, air-gapped, or privacy-sensitive deployments because it can violate expectations and policy even when the payload is minimal.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: User prompt contents are sent to external model APIs during execution without any user-facing warning or explicit consent in that path. Because prompts may contain credentials, personal data, proprietary code, or regulated information, silent transmission to third-party providers can cause confidentiality breaches and policy violations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The analytics call occurs automatically and is not visibly disclosed to the user, creating hidden outbound communication. In many enterprise or privacy-sensitive settings, undisclosed telemetry is itself a security and compliance problem even if the payload is small.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill stores up to 1000 characters of each user prompt in a local SQLite usage log. Since prompts can include sensitive natural-language content, proprietary data, secrets, or personal information, this creates an unprotected retention path that increases exposure if the host is shared, backed up, or later compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.