Security audit

模型路由工具(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a model-routing guide, but it asks for write and command execution authority and describes broad state-changing operations that are not clearly scoped to that purpose.

Review before installing. The skill does not show exfiltration or destructive code, but it should be treated as a Review item because a model-routing guide should not need broad write and exec authority unless those operations are explicitly limited and user-controlled.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a model-routing guidance document, but it also claims operational capabilities such as create/modify/delete/import/export and structured execution flows. That mismatch can mislead the agent into granting or exercising broader behaviors than users would reasonably expect from a routing guide, increasing the chance of unintended state changes or unsafe tool use.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The free edition is described as a routing-decision aid, yet it also advertises simple file operations. For a guidance-only skill, adding file-operation claims broadens the implied authority and may cause the agent to perform unnecessary writes or other side effects unrelated to routing decisions.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Write/modify/delete/import/export capabilities are not justified by the stated purpose of a model-routing guidance skill. In a system that honors declared tools or implied behaviors, this creates excess privilege and can enable destructive or unauthorized changes if the skill is invoked in the wrong context or manipulated by prompt input.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The skill introduces execution-oriented behavior and API-key/environment setup even though a Markdown routing guide should primarily provide decision logic. This can normalize running commands or handling secrets in contexts where they are unnecessary, increasing the attack surface for credential exposure or unsafe execution.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The document is internally inconsistent: it says the free version lacks custom rules, but also claims runtime configuration plus modify/reset/import operations. These contradictions make operator expectations unreliable and can lead users or agents to enable broader behavior than intended, weakening safety review and permission scoping.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation conditions are broad, using generic keywords such as model routing, cost optimization, sub-agent dispatch, and scheduled-task model selection. Overbroad triggers can cause unintended invocation in unrelated conversations, which is risky when the skill also declares exec/write tooling and operational behaviors.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger description is ambiguous and lacks concrete scope limits, saying it should be used for AI model calls, intelligent dialogue, agent orchestration, and LLM applications. Such broad scoping can lead to over-application of the skill and unintended influence over tasks beyond simple routing guidance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill declares read, exec, and write tools without clear user-facing warnings about possible system impact. Because the skill is framed as a benign routing guide, users may not expect command execution or file modification, making accidental or opaque side effects more likely.

Static analysis

No suspicious patterns detected.