Security audit

llm-gateway-hub

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local command-line gateway for LLM APIs, with expected key, file, and network behavior, though users should read the cloud-sync and “pure local” wording carefully.

Before installing, be comfortable storing provider API keys in a local JSON config and sending prompts or image requests to the model providers you configure. Keep gateway_config.json out of cloud sync, backups, chat, and repositories unless secrets are separately protected; use trusted base_url values, file permissions, low initial budgets, and key rotation. Do not interpret “pure local” as meaning no data leaves the machine during model calls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill metadata declares no permissions, yet the content describes capabilities consistent with reading environment variables, reading/writing files, and making network requests. In a gateway/key-management skill, these undeclared capabilities are security-relevant because they can expose API keys, persist sensitive usage data, and call external model providers without explicit user or platform visibility.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The report uses misleading language by calling the skill a 'pure local' CLI gateway while also acknowledging that it performs outbound network requests to external model APIs. This documentation divergence can cause reviewers or users to underestimate data egress and trust boundaries, which is security-relevant for a gateway handling prompts, keys, and billing data.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The audit conclusion labels the skill as a 'pure local tool' even though the document earlier states that external network calls are part of the core functionality. Such contradictory security conclusions can mislead deployment decisions, weaken review quality, and mask the actual exposure of prompts or secrets to remote services.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly promotes cloud synchronization between home and company machines and daily backups of team data, but it does not state what data is synchronized, whether prompts/responses/keys are excluded, or how confidentiality is preserved in third-party sync services. In a gateway handling model traffic, budgets, and potentially sensitive business content, this can lead to unintended disclosure of prompts, outputs, logs, metadata, or even secrets if operators follow the documented deployment pattern without additional safeguards.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: Broad trigger keywords such as 'llm', 'gateway', and 'hub' can cause the skill to activate in many unrelated conversations. Because this skill is positioned as a centralized LLM gateway with key and budget management, unintended invocation raises the chance of exposing sensitive operational context or causing actions to be taken when the user did not intend to use this skill.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/security_test.py:42