Model-Selector

Security checks across malware telemetry and agentic risk

Overview

This skill is a local model router, but it should be reviewed because it saves raw user prompts to disk by default.

Review before installing. Use it only if you are comfortable with routed prompts being saved locally, avoid sending secrets or sensitive business/personal data through it, restrict or regularly delete query_history.json, and consider disabling or modifying the logging before use. Pin and review the Python dependencies in a controlled environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The router persistently stores full user queries to a local JSON file even though its stated purpose is only model selection. This creates unnecessary data retention of potentially sensitive prompts, expands the skill’s behavior beyond routing, and increases exposure if the host environment, logs, or filesystem are accessed by other components or users.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The refinement hook is designed to enable later analysis of stored queries, which turns a simple router into a system for long-term prompt collection and secondary use. That broadens the privacy and data-governance risk surface because user inputs may later be reviewed or processed for purposes not disclosed by the skill’s core function.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The usage guidance is broad and underspecified: it tells an agent to invoke routing logic before main LLM calls, but provides no constraints on when the skill should trigger, what inputs are allowed, or what trust boundaries apply. In an agentic environment, ambiguous activation can cause over-invocation, unintended handling of sensitive prompts, or model/provider routing that violates policy, cost, or data-governance expectations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Writing user queries to disk without disclosure or consent is a privacy weakness, especially because queries may include credentials, business data, or personal information. In a model-routing skill, users would not reasonably expect their raw prompts to be retained locally for later review.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The code stores raw queries in plain text JSON, so any sensitive information users include is retained verbatim on disk. In shared or weakly isolated environments, that data can be read by other local users, backup systems, adjacent processes, or later tooling, making confidentiality loss a realistic risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal