Smart Router for Ollama

Security checks across malware telemetry and agentic risk

Overview

This router mostly does what it claims, but it under-discloses prompt persistence and optional web-search behavior that can send full user queries outside the Ollama routing path.

Review before installing. Configure a trusted cloud Ollama endpoint or force local-only routing, disable search unless you explicitly want web lookups, and avoid entering secrets because prompts may be logged locally, stored in SQLite conversation history, sent to a remote Ollama server, or submitted to a SearXNG endpoint for search queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code initializes a persistent SQLite database for conversation storage, enabling retention of user interaction data beyond transient routing needs. In the context of a routing skill whose description focuses on model selection and cost-efficient delegation, silently adding persistent memory broadens data handling in a way users may not expect and increases privacy risk if sensitive prompts are stored locally.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This code stores raw user messages together with classification and routing metadata for every turn, creating a durable record of potentially sensitive conversation content. Because the skill is presented as a smart router rather than a memory or logging component, this undisclosed persistence materially increases the chance of privacy violations, unintended secondary use, or exposure through local compromise.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The router silently performs web-search augmentation and injects fetched external content into the model prompt, even though the stated purpose is only local/cloud model routing. This creates an undeclared data egress path and changes trust boundaries by sending user queries to external search infrastructure without clear consent.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The added web-search capability is broader than necessary for an Ollama router and materially alters the skill's behavior from model selection to retrieval-augmented answering. In a routing skill context, hidden retrieval is more dangerous because users may reasonably expect their prompt to stay within local/cloud Ollama endpoints rather than being shared with another external service.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file introduces outbound web-search capability even though the skill is described as local/cloud Ollama task routing. That creates an unexpected networked data flow and expands the trust boundary, which can cause privacy, compliance, or policy violations if users or operators assume routing only occurs between approved model backends.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The script persistently writes detailed hardware fingerprinting data to `config/system_profile.json`, including RAM, GPU name, VRAM, CPU core count, and model recommendations. For a routing helper, persistent collection is broader than necessary and creates a local privacy and information-disclosure artifact that other components or users on the system may later read.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The invocation guidance is extremely broad (e.g. use for 'any request' balancing latency vs capability), which can cause the skill to be selected for many ordinary prompts without the user realizing routing logic or remote processing may occur. In context, that broad trigger surface is more dangerous because the skill may contact cloud endpoints and persist telemetry, making accidental over-invocation a privacy and policy risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The markdown describes cloud routing but does not give a prominent, plain-language warning that user requests may be transmitted to a remote/cloud Ollama instance. This omission is significant because task content may include sensitive data, and users may reasonably assume 'Ollama' means local/private processing unless remote transfer is clearly disclosed.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The router is explicitly designed to send tasks to either local or cloud Ollama endpoints, and this interface exposes a simple route() API without any visible user-consent gate, privacy notice, or control indicating when prompts or conversation-linked context may leave the local system. In a routing skill, user inputs may contain sensitive data, so silent transmission to remote services creates a real confidentiality risk, especially when conversation context can influence routing across multiple turns.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Persisting user messages to local SQLite without any warning or consent mechanism is a privacy and transparency failure, especially because users may enter secrets, credentials, or regulated data into prompts. Even though the storage is local, compromise of the host, backups, or shared environments could expose the stored conversation contents.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code logs user task content, routing decisions, model names, and conversation identifiers to a file without any visible notice or consent flow. Prompts often contain sensitive data, so silent persistence increases privacy risk, insider exposure, and forensic recoverability even when the user expected ephemeral processing.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The router may send the user's query to a search subsystem and merge returned content into the prompt without explicit warning. This is dangerous because it can expose sensitive user input to third-party services and introduces untrusted external content into downstream model behavior, increasing both privacy and prompt-injection risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code sends the full user task directly to an external SearXNG endpoint, defaulting to a public instance, without a clear consent or disclosure mechanism. If prompts contain secrets, internal data, or personal information, this leaks sensitive content off-box to an external service and may violate privacy expectations for a 'smart-router' skill.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
`get_search_context()` performs a remote search using the full task text and silently returns the results as context, with no user-visible indication at this call site that network transmission occurred. This hidden exfiltration path is especially risky because it may be reused by other components that assume they are only building local prompt context.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyyaml>=6.0
requests>=2.31.0
Confidence
94% confidence
Finding
pyyaml>=6.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyyaml>=6.0
requests>=2.31.0
Confidence
94% confidence
Finding
requests>=2.31.0

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal