Ai Model Router V2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent model router, but its privacy mode can still select a cloud model and its context module can store message excerpts locally in plaintext.

Review before installing. Use it only if you are comfortable with routing decisions that may name cloud models, avoid relying on its privacy mode unless you verify the primary model is local, and do not enable or integrate context recording for sensitive conversations without adding redaction and stricter storage controls. Prefer a pinned installer version instead of the documented `@latest` command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Mutable npm Package Is Downloaded and Executed During Installation

Content

View full analysis

Remediation

View remediation

install ai-model-router ``` 2. Where supported, execute a package identified by an immutable artifact digest or verify its published integrity hash before execution. 3. Document the expected package registry and publisher identity. 4. Review package lifecycle scripts and the CLI entry point for every dependency update. 5. Use automated dependency monitoring while requiring manual security review before changing the pinned version. 6. Keep both `SKILL.md` copies synchronized so neither continues recommending the mutable command. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skill/core/router.py:235

Finding

Privacy Mode Can Select a Cloud Model Instead of Failing Closed

Content

View full analysis

1: self.secondary_id = self.models[1].id elif not self.secondary_id and self.models: self.secondary_id = self.models[0].id ``` The privacy routing branch then trusts the primary model without verifying that it is local: ```python # Privacy check - always routes to primary (usually local) has_privacy, privacy_detected = self.check_privacy(task) if has_privacy: primary = self.get_model(self.primary_id) if primary: return RouteResult( model_id=primary.id, model_name=primary.name, model_type="primary", reason=f"privacy_detected:{len(privacy_detected)}_patterns", confidence=1.0, privacy_detected=privacy_detected, ) ``` ### Technical Analysis The privacy mechanism treats the logical designation `primary` as though it were equivalent to `local`. That invariant is not enforced. If local-model detection returns no models, `self.models` contains the built-in cloud registry and `self.models[0]` becomes `primary_id`. A user-provided configuration can also explicitly designate a cloud model as the primary model. When sensitive input matches a privacy pattern, the routing branch returns that primary model without checking `primary.type == "local"`. The returned `model_type` is hardcoded as `"primary"` rather than reflecting whether the selected model is local or cl ...[truncated 1593 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill/modules/context.py:55

Finding

Conversation Message Excerpts Are Persisted in Plaintext Without Redaction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description defines very broad trigger conditions like 'switch model', configuration requests, complex tasks, and mentions of API keys/passwords, which could match many normal conversations. Over-broad activation increases the chance the skill runs unexpectedly and influences routing decisions for unrelated prompts, especially around sensitive content where users may not intend automatic handling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the most recent package version without pinning or integrity control. That creates a supply-chain risk: a compromised upstream release or typosquatted dependency could cause users to run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The skill instructs users to create persistent configuration under ~/.model-router/models.json, which introduces session persistence on the local system. Persistent state is not inherently malicious, but it can retain model selections or provider identifiers across sessions, potentially affecting later behavior without clear visibility or consent.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

Configuration (Optional)

Create ~/.model-router/models.json:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description includes broad trigger conditions such as requests to "switch model," configuration requests, complex tasks, and mentions of API keys/passwords. Overbroad triggers can cause the skill to activate in ordinary conversations or when sensitive text merely appears, which increases the chance of unintended routing behavior and inappropriate handling of private content. In a model-routing skill, accidental activation around secrets makes the ambiguity more risky.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The install command uses npx clawhub@latest, which is an unpinned remote package reference. That allows whatever version is current at execution time to run on the user's machine, increasing supply-chain risk if a future release is compromised or introduces unsafe behavior. In a skill intended for installation/execution, this is a real security concern rather than a documentation-only false positive.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill/SKILL.md (reported line 86)May include surrounding context.

Configuration (Optional)

Create ~/.model-router/models.json:

json

{

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code routes any task matching a privacy pattern to self.primary_id, but nothing guarantees the primary model is local or otherwise privacy-preserving. Since configuration and auto-detection can set a cloud model as primary, sensitive prompts may be exfiltrated to a remote provider despite the code comment implying safe handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

record_message persists full conversation content through the context manager with no consent, minimization, or sensitivity gating visible in this file. If context storage is enabled, prompts and responses may be retained on disk, increasing exposure of secrets, personal data, or regulated content through local compromise or later unintended reuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring says it is for detecting local AI models, and the class/method docs emphasize reading local Ollama config and environment variables. However, detect_all() appends a built-in cloud model registry via get_cloud_registry(), so the implemented behavior is broader than the documented local-only scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Phrases like 'Compact, intelligent model routing that just works' imply automatic behavior without clearly constraining when the skill should or should not execute. While mostly marketing language, in a skill manifest this can contribute to unsafe assumptions about autonomous activation and reduce operator clarity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The route method inspects the full task text against sensitive-data patterns to detect secrets and emails, but this file does not provide any visible notice that submitted content will be scanned for privacy-related data. Although the behavior is safety-motivated, it still processes potentially sensitive user input without an explicit warning in this code file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.