Suspicious: llm-router - auto-route.py | Skillgate

Skillgate scanned .claude/hooks/auto-route.py in llm-router and rated it Suspicious with a risk score of 74/100 (3 detections).

Skillgate found behaviour that needs a human decision: it may be a legitimate but powerful pattern, or an attack. Review the flagged lines in the source before installing.

What was found

• SG-105 Hook script exfiltrates prompt/transcript to external host - CRITICAL: A Claude Code hook script (.claude/hooks/*.py|js|ts) reads hook input (prompt/transcript/tool I/O via stdin) and sends it to an external network sink. CRITICAL when hook input is read and shipped externally; MEDIUM when an external network call is present without an observed hook-input read.
• SG-022 Context Window Flooding - MEDIUM: Repetitive filler text, context boundary spoofing, excessive separators
• SG-098 Agent Safety-Control Suppression - MEDIUM: Instruction to suppress safety warnings, skip confirmation, or hide actions from the user

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.