Security audit

模型路由工具(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a model-routing guide, but it asks for exec/write authority and describes unclear create/modify/delete/reset operations that do not fit a simple advisory guide.

Review this before installing if you only want a routing reference. The risky part is not hidden malware; it is that the skill requests command and write capability while its model-routing purpose mostly needs read-only guidance. Install only if you are comfortable constraining or monitoring any file changes and command execution triggered by this skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly grants read, exec, and write tools, but the documentation does not include safety boundaries or user-facing warnings about system-impacting operations. In practice, an over-broadly triggered skill with exec/write access can execute commands or alter files under the guise of routing assistance, making the context materially more dangerous than a pure documentation skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation language says the tool auto-activates on broad keywords like model routing, cost optimization, sub-agent dispatch, and scheduled-task model selection. Such broad matching can hijack unrelated conversations and cause the agent to apply this skill in contexts where the user did not request it, increasing the chance of incorrect recommendations or unintended tool use.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The free-version limitations say custom rules are unsupported, yet other sections advertise runtime configuration changes, resets, and imports. This inconsistency can mislead the agent or user about what behavior is allowed, potentially enabling unintended configuration changes or broader routing logic than expected.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is presented as a model-routing guide, but the body claims operational capabilities such as create/modify/delete/save/export without clearly defining what resources are affected. In an agent environment with read/write/exec tools enabled, this ambiguity can cause the agent to perform state-changing actions users did not intend, expanding the skill from advisory guidance into quasi-administrative behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill describes create/query/export, modify/reset/import, and export/save/convert operations but does not warn about possible data loss, configuration drift, or persistence side effects. Users may interpret these as harmless formatting steps while the agent could perform writes or destructive changes in the environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger condition covers generic AI model calls, intelligent dialogue, agent orchestration, and LLM applications, which are extremely broad categories. In a shared agent environment, this makes over-activation likely and can route many unrelated requests through a skill that has write and exec capabilities, raising the risk of unintended actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The display name, summary, description, and operational guidance are all presented in Chinese, and the file does not indicate that this is a region-specific skill or that users can opt into another language. This may conflict with language/locale policy expectations when a skill is distributed broadly without an explicit language choice.
Content: No source excerpt is available for this finding.