Security audit

模型路由工具(专业版)

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it asks for broad read/write/command authority and API credentials while its operating scope and safeguards are too loosely defined.

Review this skill carefully before installing. It may be useful for team model-routing governance, but only use it in a workspace where command execution and file writes are acceptable, keep provider keys in environment variables or a secret manager, and require explicit confirmation for exports, config changes, provider switching, alerts, and any shell command.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims command execution is restricted by a whitelist, but the document provides generic exec capability and example commands without defining any enforceable allowlist, argument validation, or execution guardrails. In an agent environment with read/write/exec tools, this can create a false sense of safety and enable arbitrary command execution paths if user-controlled input is later incorporated into commands.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The manifest and title position this as a model-routing governance skill, but the content expands into broad automation, file processing, command execution, and operational workflows. This scope mismatch weakens least-privilege expectations and can cause agents or users to invoke powerful capabilities outside the intended routing context, increasing the chance of unsafe file or system actions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill states it will auto-activate on broad keywords such as cost governance, routing rules, budget alerts, and multi-vendor terms. Overbroad activation criteria can trigger the skill in unrelated conversations, causing unexpected use of exec/write/network-capable workflows and raising the risk of accidental unsafe actions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The usage conditions are very broad, covering efficiency improvement, automation, workflow optimization, AI model calls, agent orchestration, and LLM applications. Such ambiguity invites invocation in many contexts beyond the skill's core purpose, which is risky because the skill also advertises write and exec capabilities.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill describes export, save, and conversion operations but does not provide clear user-facing warnings, destination constraints, or confirmation requirements before modifying local data. In a tool-enabled agent, this can lead to unintended overwrites, data leakage into unsafe locations, or silent persistence of sensitive outputs.

Static analysis

No suspicious patterns detected.