T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:12
- Finding
- Automatic Routing to a Nonstandard Model Provider Without Prior Consent## Vulnerability Details **File Location**: `SKILL.md`, lines 12-14 and 39-49 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown Based on your setup: - **Fast model (haiku):** `custom-kiro-cli-vipdump-eu-org/claude-haiku-4-5` - For simple, quick tasks - **Powerful model (sonnet):** `custom-kiro-cli-vipdump-eu-org/claude-sonnet-4-5` - For complex analysis ``` ```javascript Use `session_status` tool with `model` parameter: // Switch to sonnet for complex tasks session_status({ model: "kiro-cli" }) // Switch back to haiku for simple tasks session_status({ model: "haiku" }) // Reset to default session_status({ model: "default" }) ``` ### Technical Analysis The Skill is designed to inspect user messages and automatically change the model that processes the session. Its configuration identifies models under a custom, nonstandard provider namespace, while the implementation selects them through opaque aliases such as `kiro-cli` and `haiku`. The Skill only instructs the agent to inform the user after an actual switch. It does not require advance consent, show the resolved provider endpoint, verify that the selected alias maps to an approved model, or document the destination's data-handling policy. Consequently, users may not know which provider will process their prompts and available conversation context before the routing decision occurs. The reviewed file does not contain direct credential collection, executable payloads, persistence mechanisms, or evidence that the named provider is malicious. The risk arises from automatic and insufficiently transparent model routing rather than from confirmed data theft. ### Attack Path 1. The Skill is loaded into an agent session. 2. A user submits a message containing one of the configured complexity keywords or otherwise triggers the complexity-routing logic. 3. The Skill checks the current model t ...[truncated 1103 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation before switching to a model operated by a different or custom provider. 2. Display the resolved provider name, exact model identifier, and relevant data-handling implications before performing the switch. 3. Restrict selectable models and providers to a centrally managed allowlist. 4. Validate that aliases such as `kiro-cli` and `haiku` resolve only to expected, approved destinations. 5. Prefer stable, explicit model identifiers over opaque aliases where the platform permits. 6. Provide a configuration option that disables automatic switching and defaults to user-controlled selection. 7. Document whether prompts, attachments, tool output, and prior conversation context are transmitted to the selected backend. 8. Record model-switch events in an auditable log without storing sensitive prompt content. 9. Notify the user before transmission rather than only after the routing change has occurred.