Smart Model Router

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed model router, but its automatic cloud model routing, broad triggers, and incomplete install artifacts need review before use.

Review this before installing. Confirm which model providers your prompts may be sent to, avoid sending secrets or sensitive customer data unless you trust the selected provider, and verify the missing setup script or aliases from a trusted source before running or sourcing anything in your shell profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The README explicitly encourages overriding routing to send debugging content to an external model provider, which can expose proprietary code, stack traces, secrets, or customer data to a third-party service. In a router skill whose purpose is automatic model selection, this context increases the likelihood of users transmitting sensitive material without adequate review or provider-specific data handling awareness.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

flow "Write a creative product description for our new AI tool"

Override when needed

ask --intent fix --model deepseek-r1 "Debug this race condition"

text

## Router Dashboard

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

flow "Write a creative product description for our new AI tool"

Override when needed

ask --intent fix --model deepseek-r1 "Debug this race condition"

text

## Router Dashboard

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger table uses common words like "issue," "problem," "design," and "approach" as routing cues, but these terms are broad and can appear in many everyday prompts unrelated to the intended routing. The documentation does not define precedence, limits, or non-matching examples, making activation behavior unclear.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README defines the "flow" intent as "(default) creative, conversational, general," which is not a specific trigger set and overlaps heavily with ordinary user speech. Because the trigger scope is open-ended and no exclusion examples are provided, users cannot clearly tell when this route will activate versus other intents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises automatic prompt analysis and routing benefits but does not clearly warn that user input may be inspected and sent to different models/providers. In the context of an AI router, this omission is security-relevant because users may unknowingly disclose sensitive code, credentials, or business data to external services with different privacy and retention policies.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The router relies on broad, common trigger words such as 'issue', 'problem', and 'how should', which can easily appear in ordinary prompts and cause misclassification. In this skill, misrouting can send prompts to a different model/provider than the user expected, affecting output quality and potentially exposing sensitive prompt contents to a less appropriate backend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description claims the skill will automatically detect user intent and route to an optimal model, but it does not define activation boundaries, trigger conditions, or safety constraints. In an agent-routing skill, vague auto-activation language can cause the skill to intercept unintended tasks or influence model selection broadly, increasing the chance of misrouting sensitive work or bypassing user expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.