Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only model-routing advisor with disclosed memory/profile examples and provider configuration templates, not an executable or covertly privileged skill.
Before installing, confirm you are comfortable with the skill remembering model-routing preferences and cost summaries, and review any copied provider config because prompts will go to the external APIs you enable. Also verify current model names and pricing, since the reference data is time-sensitive.
The README states that the skill performs progressive user profiling by learning preferences from conversation, but it does not warn users or obtain consent. Inferring and retaining user preferences from ongoing dialogue can create privacy and transparency issues, especially if preferences are stored, reused across sessions, or combined with other behavioral signals.
The trigger conditions are broad enough to activate on many ordinary conversations about cost, models, or AI usage, increasing the chance the skill is invoked when the user did not intend model-routing advice. In an agent setting, overbroad activation can cause prompt hijacking of unrelated workflows, unnecessary data exposure to the skill, and incorrect routing decisions based on incomplete context.
The Chinese README repeats the progressive profiling behavior without informing users that preferences will be inferred from their conversation. This creates the same privacy and consent problem for Chinese-speaking users and increases risk because the omission exists across multiple language surfaces.
The skill’s trigger logic is overly broad and forces activation for many generic cost- or model-related phrases, even when the user did not actually request routing help. This can cause inappropriate skill hijacking, where normal conversations are diverted into the skill’s behavior, increasing the chance of incorrect advice, loss of user intent fidelity, and interference with safer or more relevant skills.
The evals define very broad natural-language triggers such as any discussion of API cost, model choice, or routing, without clear activation boundaries or exclusions. In a routing skill that influences model selection, this can cause over-triggering in unrelated contexts and may suppress more appropriate domain-specific handling, especially for sensitive tasks like security review where incorrect routing can affect analysis quality and safety.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
mode: "merge"
providers:
deepseek:
baseUrl: "https://api.deepseek.com/v1"
apiKey: "${DEEPSEEK_API_KEY}"
api: "openai-completions"
models:
The routing rules use broad regex-like keyword triggers such as generic planning, coding, or security terms without anchoring, word boundaries, or contextual checks. This can cause unintended model escalation or misrouting for ordinary conversations, increasing cost and potentially sending sensitive tasks to stronger external providers unexpectedly.
The additional trigger examples rely on vague terms like 'plan', 'design', 'decide', 'complex', 'reason', and 'think', which are common in normal prompts and not specific enough for reliable routing. This ambiguity can be exploited by crafted prompts to force upgrades, alter execution paths, or defeat intended cost controls.
This markdown file is written entirely in Chinese from the title onward, with no indication that other languages are supported or that the language choice is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue unless the restriction is clearly justified.
The sample code is internally inconsistent: evaluate_quality() is documented as returning a boolean pass/fail result, but the caller compares its return value numerically with >= 0.8. In a routing skill, this can cause incorrect model-tier decisions, leading to unintended downgrades, unnecessary escalation, cost overruns, or poor-quality outputs being accepted as sufficient.
The README embeds an externally hosted image from qomob.ai that is unrelated to the core routing/advisory function. Loading third-party assets can leak viewer metadata such as IP address, user agent, and access timing, and it creates a supply-chain risk if the remote content is changed later to misleading or malicious material.
Multiple evaluation prompts and expectations are written in Chinese and appear to assume operation in that language, but the file does not state that language choice is optional or limited to a justified locale-specific context. This can be a language/locale policy issue if the skill behavior is effectively constrained to one language without user opt-in.
The sample configuration sets primary_language: zh as the default, and later examples repeat Chinese as the selected primary language. This can be a language/locale policy concern if users adopt the template as-is without being clearly prompted to choose their preferred language.
The title and the entire document are written in Chinese, and there is no indication that language selection is optional or that the content is intentionally limited to a Chinese-speaking audience. The stated policy flags locale or language constraints when they are imposed without user opt-in or clear justification.