Model Routing Skill

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  1.0.1

Overview

This is a small instruction-only model-routing skill with narrow disclosed routing metadata logging and no executable code or privilege requests.

Install this if you want automatic model routing with simple cost and fallback guardrails. Before installing, confirm that logging task type, chosen model, and applied caps to an internal trace is acceptable for your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill explicitly states that it records request metadata to an internal trace, but it does not indicate any user notice, consent flow, or clear limitation on what may be captured. Even though the fields listed are lightweight, undisclosed telemetry can create privacy and compliance risk, especially if task classification or routing metadata is retained or correlated with user activity.

VirusTotal

63/63 vendors flagged this skill as clean.