Security audit

Token Router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent model-selection and cost-optimization advisor, with disclosed memory use for preferences and routing history.

Before installing, consider whether you are comfortable with the skill saving model-routing preferences, budget hints, task categories, feedback, and estimated cost history in Memory. It does not show hidden commands or credential access, but users who do not want cross-session personalization should avoid or clear its memory records.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The skill instructs building and storing a persistent user profile with strategy, budget, overrides, and upgrade history across turns. For a model recommendation skill, retaining conversation-derived preference and budget data beyond the immediate session is more data than is strictly needed and increases privacy risk if memory is later exposed, reused out of context, or accessed by other skills/components.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill directs persistent collection of conversation-derived preferences and feedback in memory, including a structured profile that can survive across turns. This creates unnecessary retention of user behavioral data and expands the blast radius of any memory leakage, cross-skill access, or misuse because the information can be correlated over time.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The session trace schema records user intent, router decisions, estimated token usage, cost, and user feedback for every turn. This is detailed telemetry that can reveal behavioral patterns and potentially sensitive workflow information; if retained or exposed, it enables profiling far beyond what is necessary to answer a single recommendation request.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The cross-session learning registry stores historical rejection patterns, task types, tier adjustments, and accumulated interaction history for future reuse. This persistent behavioral memory is not essential for most model-routing interactions and can be exploited for long-term profiling or inadvertently leak prior user behavior into future sessions or contexts.

Static analysis

No suspicious patterns detected.