Lynkr AI Routing Proxy

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:07 PM UTC
• Version: 8.0.1

Overview

The skill describes a legitimate LLM routing proxy, but its install and local data exposure are under-scoped for software that handles coding prompts and provider access.

Review the upstream package and installer before installing. Prefer a pinned version, an isolated environment or dedicated user account, localhost-only binding, endpoint authentication, and a clear way to disable or purge telemetry, prompt cache, and long-term memory before routing sensitive code or credentials through it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unpinned Third-Party Package with Automated Secondary Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-55
Vulnerability Type: Supply-chain risk from unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install -g lynkr
lynkr-setup   # Auto-installs Ollama + pulls a model
lynkr          # Start the proxy

Technical Analysis

The installation instructions globally install the lynkr npm package without pinning an exact version and then execute its setup command. The package version resolved during installation can therefore change independently of the reviewed Skill.

The setup command is documented as automatically installing Ollama and downloading a model, introducing additional executable software and artifacts without specifying their versions, download locations, signatures, or cryptographic checksums. Because the audited project contains only SKILL.md, neither the npm package implementation nor the secondary installation process can be independently reviewed from this artifact.

The global installation scope also exposes package-provided commands outside an isolated project environment. Any npm lifecycle scripts associated with the resolved package may execute during installation with the invoking user's privileges.

Attack Path

1. An attacker compromises or replaces a future lynkr npm release, its dependency chain, or an artifact retrieved by lynkr-setup.
2. A user follows the documented command, which resolves the package version available at installation time rather than a specifically reviewed release.
3. Malicious npm lifecycle code or setup logic executes with the user's privileges.
4. The secondary installer may retrieve and execute additional compromised software or model artifacts.
5. The malicious code may access resources available to the user, including local files, provider credentials, AI prompts, and system or application configuration.

Impact Assessment

Successful exploitation could result in arbitrary code execu ...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to an exact reviewed version, for example:

   bash

   npm install -g lynkr@8.0.1
   

2. Prefer a project-local installation governed by a committed lockfile instead of a global installation.

3. Publish and reference auditable source code for lynkr-setup and all installation scripts.

4. Pin Ollama and downloaded model artifacts to specific reviewed versions.

5. Document every artifact source and verify downloads using trusted digital signatures or published cryptographic hashes.

6. Avoid automatic secondary installation where possible. Display the intended system changes and require explicit user confirmation before downloading or executing additional software.

7. Disable or strictly review npm lifecycle scripts during installation where operationally feasible.

8. Run the gateway under a dedicated, least-privileged account and isolate it from unrelated credentials and sensitive files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises SQLite-backed routing telemetry and multiple telemetry/admin endpoints, but it does not clearly warn users that request metadata may be stored and exposed through local HTTP endpoints. In a proxy handling AI coding requests, that metadata can include sensitive prompts, model usage details, and operational traces, so omission of this warning creates a real privacy and security risk even if the feature is intended for observability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.