Request: Add a detection rule for model: / provider: pins in skill frontmatter (and body-level shell-outs to other coding CLIs), flagging them as unexpected billing/cost exposure.
Why: I ran a project-level skill that carried a model: claude-* pin. It silently switched my session from my default (DeepSeek Flash) to Claude mid-task, and I only noticed when Claude burned a full month of premium credits. The skill passed every security check — no prompt injection, no exfiltration, no dangerous commands — it just overrode the model and billed a different account than I expected.
Suggested behavior:
model: / provider: / model_name: / model_id: in frontmatter → flag MEDIUM (billing/cost exposure)- Body shell-outs like
claude -p, codex exec, cmd -m claude → flag HIGH (silent account switch)
Model pins are legitimate in isolation (first-class feature in most agent skill specs, like allowed-tools), which is why I'd frame it as cost-exposure rather than malicious — but combined with an operator's default-model expectation, they're a real footgun. This fits naturally under the existing excessive-agency family.
Request: Add a detection rule for
model:/provider:pins in skill frontmatter (and body-level shell-outs to other coding CLIs), flagging them as unexpected billing/cost exposure.Why: I ran a project-level skill that carried a
model: claude-*pin. It silently switched my session from my default (DeepSeek Flash) to Claude mid-task, and I only noticed when Claude burned a full month of premium credits. The skill passed every security check — no prompt injection, no exfiltration, no dangerous commands — it just overrode the model and billed a different account than I expected.Suggested behavior:
model:/provider:/model_name:/model_id:in frontmatter → flag MEDIUM (billing/cost exposure)claude -p,codex exec,cmd -m claude→ flag HIGH (silent account switch)Model pins are legitimate in isolation (first-class feature in most agent skill specs, like
allowed-tools), which is why I'd frame it as cost-exposure rather than malicious — but combined with an operator's default-model expectation, they're a real footgun. This fits naturally under the existing excessive-agency family.