Security audit

模型切换工具(免费版)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a model-selection guide, but it asks for broad read/write/exec authority and describes under-scoped actions that go beyond simple guidance.

Review this skill carefully before installing. It does not show malicious behavior or hidden exfiltration, but its requested local authority and broad activation language are stronger than a simple model-selection reference needs. Use it only if you are comfortable limiting when it runs, and avoid giving it permission to write files, execute commands, or handle API keys unless a specific task clearly requires that.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a model-switching guide, but the capability section expands into generic create/query/modify/delete/import/save operations without defining scope or safety boundaries. In an agent platform with read/write/exec tools, this ambiguity can mislead the orchestrator or user into allowing broader state-changing actions than the skill’s stated purpose warrants.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document says the skill will 'auto-activate' on broad keywords, while later claiming the free version only supports manual switching and lacks automation. That contradiction increases the chance of unintended invocation and hidden behavior, especially in environments where skill text influences routing or tool use.

Context-Inappropriate Capability

Low

Confidence: 81% confidence
Finding: For a skill whose stated purpose is guidance on model selection, asking users to configure API keys and run network-diagnostic commands expands the operational surface unnecessarily. While not directly exploitative by itself, it normalizes credential handling and command execution in a context that does not clearly require either, which can lead to unsafe operator behavior.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases include broad terms like model switching, cost optimization, agent distribution, and scheduled-task model choice, which can match many ordinary AI-assistant requests. Overbroad activation can cause the skill to intercept unrelated tasks and influence tool selection or workflow decisions outside its intended scope.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The documented trigger scope says the skill should be used for AI model calls, intelligent dialogue, agent orchestration, and LLM applications, which is so broad that it lacks meaningful boundaries. In practice this can turn a niche advisory skill into a near-default interceptor for general AI work, increasing the chance of unintended tool use and policy drift.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The metadata advertises read, exec, and write tools, but the document does not prominently warn users that these capabilities can affect files or the local system. In an agent setting, exposing powerful tools without clear consent and safety language increases the risk of unexpected file changes or command execution under a benign-looking skill description.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill references configuring `ANTHROPIC_API_KEY` and similar credentials but gives no privacy or secret-handling warning. That omission can lead users to paste secrets into chat, logs, or unsafe files, which is a common security failure mode in agent workflows.

Static analysis

No suspicious patterns detected.