Advanced Dispatcher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:42 PM UTC
• Version: 1.0.1-alpha

Overview

The skill is a coherent model-routing dispatcher, but its Claude opt-in check is too loose and can route tradeoff prompts to Anthropic models from flag-like text that is not a clear user authorization.

Install only if you are comfortable with this skill routing prompts among multiple model providers. Treat any prompt containing --force-claude-like text carefully, especially copied documentation or untrusted task text, because the current parser can interpret embedded variants as Claude authorization.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: dispatcher.py:145

Finding

Partial-String Flag Matching Can Unintentionally Authorize Claude Routing

Content

View full analysis

Vulnerability Details

File Location: dispatcher.py, lines 145-157; related flag declaration and standard-route check at lines 19 and 132
Vulnerability Type: Improper authorization-token parsing
Risk Level: Medium

Vulnerable Code

python

_FORCE_CLAUDE_FLAG = "--force-claude"

python

def _tradeoff_route(self, prompt: str) -> RoutePlan:
    if _FORCE_CLAUDE_FLAG in prompt:
        parallel = (
            self._run(ModelCatalog.SONNET, role="proposal"),
            self._run(ModelCatalog.OPUS, role="proposal"),
        )
        return RoutePlan(
            mode="tradeoff-force-claude",
            parallel=parallel,
            judge=self._run(ModelCatalog.CODE_ARCH, role="judge"),
            reason="tradeoff route with Claude forced only for proposal generation",
            used_force_claude=True,
        )

The same substring test also appears in the standard routing path:

python

if _FORCE_CLAUDE_FLAG in prompt:
    return RoutePlan(
        mode="standard",
        primary=self._run(model, role="primary"),
        reason=(
            "standard routing; --force-claude applies only to tradeoff proposal generation"
        ),
        used_force_claude=True,
    )

Technical Analysis

The dispatcher treats the presence of --force-claude anywhere within the prompt as authorization to use Anthropic models. The expression:

python

_FORCE_CLAUDE_FLAG in prompt

performs unrestricted substring matching rather than validating an exact control token. Consequently, larger or unrelated strings such as --force-claude-disabled, example--force-claude, or documentation containing the flag text satisfy the authorization check.

For a prompt also recognized as a tradeoff request, this causes the dispatcher to produce a route containing:

• anthropic/claude-sonnet-4-6
• anthropic/claude-opus-4-6

Although this module only cons ...[truncated 1753 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace substring matching with explicit flag parsing. Prefer a structured API argument that separates routing controls from user-supplied prompt text:

   python

   def route(
       self,
       prompt: str,
       *,
       domain: str,
       force_claude: bool = False,
   ) -> RoutePlan:
       ...
   

2. If compatibility requires prompt-embedded flags, tokenize the control portion and require exact equality rather than substring containment. Reject malformed variants such as --force-claude-disabled.

3. Remove recognized routing flags from the content passed to downstream models so control tokens are not treated as task data.

4. Centralize flag parsing so standard and tradeoff routing use the same validated result rather than independently searching the raw prompt.

5. Add negative unit tests covering:

   • --force-claude-disabled
   • prefix--force-claude
   • --force-claude=something
   • documentation or quoted examples containing the flag
   • case variants, with an explicitly documented case-sensitivity policy
   • multiple conflicting or malformed flags

6. Preserve the existing invariant test confirming that Claude never appears in build pipelines, including when malformed force-flag strings are present.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description advertises a very broad set of use cases and can be matched outside narrow, explicit triggers, increasing the chance of unintended activation mid-session. In a dispatcher skill, accidental activation is risky because it can reroute work, alter model selection behavior, and invoke multi-step build flows when the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tradeoff trigger is defined by common language like 'which is better,' which overlaps heavily with ordinary user conversation and can cause the skill to activate when the user is merely asking a general comparative question. Because this skill changes routing behavior and may propose spawning additional models, this broad trigger meaningfully increases the chance of unintended orchestration and policy bypass of the user's expected workflow.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

Must not:
- Rewrite architecture
- Add abstractions
- Expand scope

## Implementation contract

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and manifest frame Claude handling as a meaningful routing control, but in _standard_route the presence of --force-claude only changes the reason text and used_force_claude flag while still routing to the same non-Claude model. This is an intent/documentation contradiction because the code records the flag as applied even though it has no effect on the actual model choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.