Security audit

skill-router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad always-on router that is coherent in purpose, but it asks the agent to run an unpackaged local script and dispatch other skills with too little containment.

Review this before installing. It is not clearly malicious, but it can become the default gatekeeper for all messages and can run an external local router script that was not included in the package. Only install it if you trust the referenced router_engine.py, understand which skills and inactive archived skills it may call, and are comfortable with routing decisions being made without confirmation when the engine reports success.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to invoke an external Python script via a shell command using raw user input as an argument. That expands the router from passive intent classification into code/tool execution, and if the surrounding runtime does not strongly sandbox or safely pass arguments, it can enable command injection, unsafe tool invocation, or unintended privileged local access.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The router is authorized to read and execute archived or inactive skills from absolute filesystem paths, which broadens its authority beyond normal dispatch. This creates a path for invoking deprecated, less-reviewed, or unexpectedly powerful skills and increases filesystem exposure, especially because absolute paths bypass normal package-level controls.

Vague Triggers

High

Confidence: 91% confidence
Finding: The absence of a concrete trigger list and negative examples for natural-language routing makes the router's behavior underspecified and unpredictable. That ambiguity increases the chance of false activations, user-intent confusion, and adversarial prompt phrasing that coerces dispatch into unintended skills or bundles.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The absence of a concrete trigger list and negative examples for natural-language routing makes the router's behavior underspecified and unpredictable. That ambiguity increases the chance of false activations, user-intent confusion, and adversarial prompt phrasing that coerces dispatch into unintended skills or bundles.

Static analysis

No suspicious patterns detected.