Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documented LLM routing proxy whose sensitive behaviors are expected for that purpose, with no hidden execution, deception, or bundled malicious code found.
Before installing, treat this as an LLM traffic router: prompts may be forwarded to whichever local or cloud providers you configure, and provider API keys may be saved in local config files. Bind it only to trusted interfaces, enable a router API key if exposed beyond localhost, keep .env/upstreams.json out of source control, and avoid sending sensitive data to providers you have not approved.
The documentation describes routing requests to upstream providers but does not clearly warn that user prompts and request contents may be transmitted to third-party LLM services. In a proxy/router skill, that omission can mislead operators into sending sensitive data through external services without informed consent or data-handling review.
The provider setup wizard documentation says it writes upstreams.json and may update .env, but it does not warn that API keys and endpoint configuration may be stored on disk in plaintext. This increases the risk of credential exposure through source control commits, backups, shared machines, or weak filesystem permissions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
**Star History**
[](https://star-history.com/#pathemata-mathemata/xrouter&Date)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- ollama run llama3.1
Test request
curl -i http://localhost:3000/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{"model":"any","messages":[{"role":"user","content":"Fix this sentence: I has a apple."}]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- ollama run llama3.1
Test request
curl -i http://localhost:3000/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{"model":"any","messages":[{"role":"user","content":"Fix this sentence: I has a apple."}]}'
The model-list fetching section explains that the wizard queries external provider endpoints but omits a warning that these requests disclose network metadata and may use configured credentials. While this is expected behavior for provider discovery, failing to disclose it can surprise users in restricted or privacy-sensitive environments.
No suspicious patterns detected.