Smart Router

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:52 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent remote-model router, but it can automatically send broad user prompts and images to a configured provider without clear consent boundaries or HTTPS enforcement.

Review this before installing if you handle private, regulated, or business-sensitive content. Configure only trusted HTTPS providers, use a limited API key with spending controls, and avoid letting the router automatically process sensitive prompts or attachments until the skill documents clear consent and routing boundaries.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/call-model.sh:100

Finding

API Credentials and User Content Can Be Transmitted Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

&2 exit 1 } ;; *) echo "SMART_ROUTER_BASE_URL must use HTTPS" >&2 exit 1 ;; esac curl --proto '=https' --tlsv1.2 ... ``` 7. Document clearly that prompts, image URLs, and generated-task content are disclosed to the configured external provider. 8. Use provider credentials with the narrowest available permissions, spending limits, and expiration period. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/call-model.sh:143

Finding

Predictable Temporary Files Allow Symlink Overwrites and Local Data Disclosure

Content

View full analysis

"$outfile" echo "Image saved: $outfile" ``` From `scripts/call-model.sh:191-197`: ```bash local outfile="/tmp/smart-router-tts-$(date +%s).mp3" curl -sS --max-time 120 "$BASE_URL/audio/speech" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$body" \ -o "$outfile" ``` From `scripts/sync-models.sh:66-67`: ```bash echo "Full list saved to /tmp/smart-router-models.json" echo "$response" | jq '.data | sort_by(.id)' > /tmp/smart-router-models.json ``` ### Technical Analysis Generated image and audio files use names based only on the current Unix timestamp in seconds. These names are predictable and may collide when multiple operations execute within the same second. The model-list output uses a completely fixed path. The scripts do not create these files exclusively, verify that the destination is a regular file owned by the invoking user, or establish restrictive permissions before writing. Shell redirection and `curl -o` can therefore follow a pre-existing symbolic link. On a multi-user system, another local user can pre-create the expected path as a symbolic link to a file writable by the Skill's user. The subsequent operation overwrites that target with API output. Depending on the invoking user's `umask`, generated media or provider model metadata may also be readable by other local users. ### Attack Path 1. A local attacker identifies the fixed model-list path or predicts the image or audio filename from the current timestamp. 2. The attacker creates a symbolic link at that path pointing to a file writable by the user who will invoke the Skill. 3. The victim invo ...[truncated 1035 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description centers on an 'intelligent multi-model router' that automatically chooses among 35+ models by task type and supports alias-based model selection. This code chunk does not do that. It only accepts an explicit --model argument and forwards requests to standard OpenAI-compatible endpoints. Supported behaviors are limited to chat, optional image input for vision-style chat, image generation, a simple chat-completions call labeled async, and TTS. There is no evidence of automatic routing, task classification, alias parsing, model catalog use beyond reading provider env var names from models.json, or video generation. Thus the actual behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description is about a runtime smart router that chooses the best model for different task types and supports alias-based model selection. The supplied code chunk does not implement routing behavior at all. Instead, it is a maintenance/discovery script used to fetch and inspect the provider's available models, group them by keyword-based categories, and save the results locally. While this may support the broader router skill by helping maintain its model catalog, the chunk's primary purpose is materially different from the declared end-user functionality. Therefore this code chunk is a mismatch with the declared description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill encourages routing prompts, images, and generation requests to arbitrary OpenAI-compatible endpoints, but it does not warn users that their content may be transmitted to third-party providers. In this context, the omission is dangerous because the skill is explicitly designed to handle user messages and images, increasing the chance that sensitive or regulated data is sent off-platform without informed consent.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README says the router 'kicks in automatically' for normal conversation, but does not clearly define activation boundaries, consent, or how routing decisions are constrained. In a skill that can redirect prompts and attachments to different external model providers, vague auto-activation increases the chance of unintended handling of sensitive inputs, unexpected provider selection, or bypass of user expectations about which model/service receives their data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger table routes broad everyday requests like translation, summarization, writing, Q&A, design poster, debugging, and deep analysis without clear exclusion conditions or negative examples. Because these are common phrases across many contexts, the skill may activate unintentionally rather than only when the user specifically wants external model routing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

if [[ -z "$BASE_URL" ]]; then
  echo "Error: environment variable $BASE_URL_ENV is not set" >&2
  echo "Set it to your OpenAI-compatible API base URL (e.g. https://api.openai.com/v1)" >&2
  exit 1
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/call-model.sh (reported line 19)May include surrounding context.

sh

if [[ -z "$BASE_URL" ]]; then
  echo "Error: environment variable $BASE_URL_ENV is not set" >&2
  echo "Set it to your OpenAI-compatible API base URL (e.g. https://api.openai.com/v1)" >&2
  exit 1
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This call transmits prompt content and optional image data to an external service using a user-configurable base URL and bearer token. The main danger is data exfiltration or accidental disclosure of sensitive inputs to an untrusted or misconfigured endpoint, which is more significant in a router skill designed to forward arbitrary user requests.

Content

Scanner excerpt · scripts/call-model.sh (reported line 104)May include surrounding context.

sh

'{model: $model, messages: $messages, max_tokens: $max_tokens, temperature: $temperature}')

  local response
  response=$(curl -sS --max-time 120 "$BASE_URL/chat/completions" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$body")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends user prompts and optional image URLs directly to a configurable remote API endpoint without any in-script disclosure, confirmation, or trust restriction. In this skill context, routing user content to arbitrary OpenAI-compatible endpoints increases privacy and data-handling risk, especially if the endpoint is self-hosted or third-party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

Image-generation requests send user prompts to an external provider without any trust validation of the destination. If the configured endpoint is malicious or insecure, user content may be logged, retained, or repurposed without consent.

Content

Scanner excerpt · scripts/call-model.sh (reported line 128)May include surrounding context.

sh

'{model: $model, prompt: $prompt, size: $size, n: 1}')

  local response
  response=$(curl -sS --max-time 180 "$BASE_URL/images/generations" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$body")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The async/chat path also forwards user-supplied content to an external endpoint controlled by configuration. In a multi-model routing skill, this broad forwarding behavior can expose sensitive task content to third parties if provider configuration is unsafe.

Content

Scanner excerpt · scripts/call-model.sh (reported line 166)May include surrounding context.

sh

'{model: $model, messages: [{"role": "user", "content": $prompt}], stream: false}')

  local response
  response=$(curl -sS --max-time 300 "$BASE_URL/chat/completions" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$body")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The TTS function sends prompt text to a remote audio endpoint and writes the returned file locally. The transmission itself is the primary concern, since potentially sensitive text may be disclosed to a third-party service without explicit warning in the script.

Content

Scanner excerpt · scripts/call-model.sh (reported line 197)May include surrounding context.

sh

local outfile="/tmp/smart-router-tts-$(date +%s).mp3"

  curl -sS --max-time 120 "$BASE_URL/audio/speech" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$body" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script retrieves an API credential from an environment variable and uses it for authenticated outbound requests. Although missing credentials produce an error, there is no explicit disclosure in the help text or comments warning users that the skill consumes authentication material from the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.