ClawHub
Back to skill

Security audit

Smart Model Router

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it needs review because it can automatically route arbitrary prompts to different cloud models and does not clearly explain consent, privacy, history storage, or uninstall controls.

Install only if you are comfortable with your prompts being automatically sent to the listed model backends. Before using it with private code, credentials, customer data, or regulated information, confirm which providers receive prompts, whether routing history is stored or exported, how to disable automatic routing, and how to undo the shell startup change.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The routing logic relies on common, unconstrained keywords such as 'bug', 'issue', 'design', and 'pattern' to determine which model receives a prompt. This can misclassify ordinary user input, causing sensitive or inappropriate requests to be routed to a different backend than the user expects, which is especially risky when different models may have different privacy, cost, or capability characteristics.

Vague Triggers

Medium
Confidence
82% confidence
Finding
Defining the default 'flow' intent as broadly covering general, creative, and conversational input means almost any unmatched prompt will be routed there without strong assurance that it is the correct destination. In a router skill, this increases the chance of unintended model selection and accidental disclosure of prompts to a default backend when the user may have expected a more private or specialized route.

Static analysis

No suspicious patterns detected.