Security audit

中国AI API统一网关

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built as an AI API gateway, but it needs Review because it can route prompts and API keys to third-party providers with inconsistent provider scope and weak exposure controls.

Review before installing. Use it only if you intend to send prompts to external AI providers, avoid sending secrets or regulated data, use environment variables or test keys with spending limits, disable fallback or pin a provider for sensitive workloads, and run the gateway on localhost or behind authentication rather than exposing it publicly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill manifest explicitly excludes overseas-model direct access, but this document still includes OpenRouter and Google AI Studio guidance. That mismatch can cause users or downstream agents to route prompts, data, and credentials to unintended external providers, violating the skill’s declared scope and potentially policy or data-residency expectations.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad, common, and loosely scoped, making accidental activation more likely during ordinary discussion about APIs, models, or switching providers. In skill-routing systems, unintended activation can cause irrelevant instructions to be injected and may steer users toward external services and credential-handling flows they did not request.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The example activation scenarios include everyday phrases like '换个AI' and '接口怎么调' without enough domain restriction, which increases the chance of the skill firing in unrelated conversations. Because the skill contains extensive third-party API guidance, mistaken activation can expose users to unnecessary data-sharing and credential setup instructions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill provides copy-pastable curl and Python examples that send user prompts and bearer tokens to third-party providers, but it does not clearly warn that prompts, metadata, and credentials are leaving the local environment. In a skill focused on aggregating external AI services, this omission is especially important because users may paste sensitive business data into examples without understanding the privacy implications.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The gateway forwards user-supplied prompts and message content directly to third-party AI providers, which creates a real privacy and data-governance risk if users are not clearly informed that their inputs leave the local service boundary. In this skill’s context, the whole purpose is routing requests across multiple external providers, including automatic fallback, which increases the chance that sensitive prompts may be sent to a different upstream than the user expected.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.