Model Switcher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:58 PM UTC
• Version: 1.0.2

Overview

This skill does what it says, but it can automatically route future prompts to a custom model provider before the user has clearly approved that switch.

Install only if you trust the custom model provider and are comfortable with the skill changing the active model during a session. For sensitive work, prefer requiring explicit confirmation before any model switch and verify what the aliases resolve to.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

Automatic Routing to a Nonstandard Model Provider Without Prior Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14 and 39-49
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

markdown

Based on your setup:
- **Fast model (haiku):** `custom-kiro-cli-vipdump-eu-org/claude-haiku-4-5` - For simple, quick tasks
- **Powerful model (sonnet):** `custom-kiro-cli-vipdump-eu-org/claude-sonnet-4-5` - For complex analysis

javascript

Use `session_status` tool with `model` parameter:

// Switch to sonnet for complex tasks
session_status({ model: "kiro-cli" })

// Switch back to haiku for simple tasks
session_status({ model: "haiku" })

// Reset to default
session_status({ model: "default" })

Technical Analysis

The Skill is designed to inspect user messages and automatically change the model that processes the session. Its configuration identifies models under a custom, nonstandard provider namespace, while the implementation selects them through opaque aliases such as kiro-cli and haiku.

The Skill only instructs the agent to inform the user after an actual switch. It does not require advance consent, show the resolved provider endpoint, verify that the selected alias maps to an approved model, or document the destination's data-handling policy. Consequently, users may not know which provider will process their prompts and available conversation context before the routing decision occurs.

The reviewed file does not contain direct credential collection, executable payloads, persistence mechanisms, or evidence that the named provider is malicious. The risk arises from automatic and insufficiently transparent model routing rather than from confirmed data theft.

Attack Path

1. The Skill is loaded into an agent session.
2. A user submits a message containing one of the configured complexity keywords or otherwise triggers the complexity-routing logic.
3. The Skill checks the current model t ...[truncated 1103 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before switching to a model operated by a different or custom provider.
2. Display the resolved provider name, exact model identifier, and relevant data-handling implications before performing the switch.
3. Restrict selectable models and providers to a centrally managed allowlist.
4. Validate that aliases such as kiro-cli and haiku resolve only to expected, approved destinations.
5. Prefer stable, explicit model identifiers over opaque aliases where the platform permits.
6. Provide a configuration option that disables automatic switching and defaults to user-controlled selection.
7. Document whether prompts, attachments, tool output, and prior conversation context are transmitted to the selected backend.
8. Record model-switch events in an auditable log without storing sensitive prompt content.
9. Notify the user before transmission rather than only after the routing change has occurred.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough that the skill may auto-activate for many ordinary requests involving analysis, design, optimization, or explicit model-switch mentions. In an agentic environment, ambiguous activation can cause unintended model changes, reduce predictability, and create opportunities for prompt-trigger abuse where users manipulate routing behavior rather than task content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill hard-codes Chinese-language trigger keywords without documenting that behavior as a locale-specific limitation or offering alternatives. This can lead to inconsistent activation, surprising behavior across languages, and easier accidental or adversarial triggering for Chinese inputs while silently failing for others.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.