Skill Trust Decision

cn-llm-router

Name: cn-llm-router Trust Review Report
Item: cn-llm-router
Rating: 80
Author: ClawSafe

核心功能安全的 LLM 路由工具，存在 2 处轻微瑕疵：calibrate.py 中受控的 eval() 使用（测试代码）和文档未提及的阴影功能。整体无恶意行为，密钥管理规范。

Install decision first Source: ClawHub Scanned: Aug 24, 2026

Files 38

Artifacts 15

Violations 0

Findings 3

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

15 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

受控 eval() 使用 +15

_core/calibrate.py:97,113 调用 eval(case['check'])(response)，但 check 来自预定义测试用例（非外部输入），风险受控

阴影功能 +5

calibrate.py（能力实测校准器）未在 SKILL.md 声明，文档-行为存在小差异

Most important evidence

Medium RCE

calibrate.py 使用 eval() 执行测试检查逻辑

_core/calibrate.py 第 97 和 113 行存在 eval(case['check'])(response) 调用。check 来自预定义的 CLASSIFICATION_CASES/CODE_CASES/LONG_CASES（非外部输入），但 eval() 本身存在理论风险。

_core/calibrate.py:97,113

建议改用 AST parse 验证或白名单函数池（如仅允许 'lambda r: ... in r ...' 模式），避免通用 eval()

Low Doc Mismatch

SKILL.md 未声明 calibrate.py 校准工具

v2.5.0 新增的 calibrate.py（能力实测校准器）是阴影功能，SKILL.md 未提及。这是开发工具而非核心功能，但应补充说明。

_core/calibrate.py:1

在 SKILL.md 第七节或 FAQ 中补充说明 calibrate.py 的存在和用途

Info Sensitive Access

缓存/SQLite 文件存储在用户主目录

cache.db 和 calls.db 默认存储在 ~/.cn_llm_router/ 目录，包含用户 query 和模型响应（无密钥）。SKILL.md 已声明，数据本地存储不外传。

scripts/cache.py:16

无需行动，已在 SKILL.md 中声明，用户可随时 cache clear 删除

Declared capability vs actual capability

Network Pass

Declared READ

→

Inferred READ

urllib.request.urlopen 调用各厂商官方 API

Filesystem Pass

Declared WRITE

→

Inferred WRITE

cache.py/cost_tracker.py 写入本地 SQLite，report.py 导出 HTML

Environment Pass

Declared READ

→

Inferred READ

config.py:get_key() 仅读取环境变量读取 API Key

Shell Pass

Declared NONE

→

Inferred NONE

无 subprocess/os.system 调用

Suspicious artifacts and egress

Medium External URL

https://skillhub.cn/skill/cn-llm-router

SKILL.md:364

Medium External URL

https://qianfan.baidubce.com/v2

_core/adapters/ernie.py:12

Medium External URL

https://aip.baidubce.com/oauth/2.0/token?grant_type=client_credentials

_core/adapters/ernie.py:70

Medium External URL

https://api.deepseek.com

references/models.yaml:21

Medium External URL

https://dashscope.aliyuncs.com/compatible-mode/v1

references/models.yaml:45

Medium External URL

https://open.bigmodel.cn/api/paas/v4

references/models.yaml:84

Medium External URL

https://api.moonshot.cn/v1

references/models.yaml:115

Medium External URL

https://api.hunyuan.cloud.tencent.com/v1

references/models.yaml:146

Medium External URL

https://ark.cn-beijing.volces.com/api/v3

references/models.yaml:185

Medium External URL

https://aip.baidubce.com/rpc/2.0/ai_custom/v1/wenxinworkshop/chat/completions_pro

references/models.yaml:208

Medium External URL

https://api.minimax.chat/v1

references/models.yaml:248

Medium External URL

https://api.lingyiwanwu.com/v1

references/models.yaml:271

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
websocket-client	`可选（不装不影响功能）`	pip	No	仅讯飞星火 WebSocket 传输用，不装时其余 11 家完全正常
sentence-transformers	`可选（模糊缓存增强）`	pip	No	模糊缓存可选依赖，未安装时降级为 difflib，零强制依赖

File composition

38 files · 6371 lines

Python 30 files · 5052 linesMarkdown 2 files · 747 linesYAML 1 files · 421 linesJSON 5 files · 151 lines

Files of concern · 4

SKILL.md Markdown · 688 lines

https://skillhub.cn/skill/cn-llm-router · [email protected]

references/models.yaml YAML · 421 lines

https://api.deepseek.com · https://dashscope.aliyuncs.com/compatible-mode/v1 · https://open.bigmodel.cn/api/paas/v4 · https://api.moonshot.cn/v1 · https://api.hunyuan.cloud.tencent.com/v1 · https://ark.cn-beijing.volces.com/api/v3 · https://aip.baidubce.com/rpc/2.0/ai_custom/v1/wenxinworkshop/chat/completions_pro · https://api.minimax.chat/v1 · https://api.lingyiwanwu.com/v1 · https://api.baichuan-ai.com/v1 · https://api.stepfun.com/v1

_core/calibrate.py Python · 252 lines

calibrate.py 使用 eval() 执行测试检查逻辑 · SKILL.md 未声明 calibrate.py 校准工具

scripts/cache.py Python · 193 lines

缓存/SQLite 文件存储在用户主目录

Other files · router.py · test_router.py · mock_engine.py · mock_data.json · cost_tracker.py · cost_tracker.py +2

38 files · 249.4 KB · 6371 lines

Python 30f · 5052LMarkdown 2f · 747LYAML 1f · 421LJSON 5f · 151L

├─ ▾ 📁 _core

│ ├─ ▾ 📁 adapters

│ │ ├─ 🐍 __init__.py Python 21L · 654 B

│ │ ├─ 🐍 base.py Python 103L · 3.9 KB

│ │ ├─ 🐍 ernie.py Python 118L · 4.9 KB

│ │ ├─ 🐍 openai_compat.py Python 91L · 3.8 KB

│ │ └─ 🐍 spark.py Python 143L · 5.4 KB

│ ├─ 🐍 cache.py Python 193L · 6.8 KB

│ ├─ 🐍 calibrate.py Python 252L · 9.6 KB

│ ├─ 🐍 config.py Python 91L · 3.1 KB

│ ├─ 🐍 cost_tracker.py Python 211L · 7.1 KB

│ ├─ 🐍 health_check.py Python 181L · 5.8 KB

│ ├─ 📋 version.json JSON 1L · 230 B

│ └─ 🐍 yaml_simple.py Python 209L · 6.3 KB

├─ ▾ 📁 references

│ ├─ 📋 mock_data.json JSON 137L · 7.3 KB

│ ├─ 📋 models.yaml YAML 421L · 9.8 KB

│ └─ 📝 routing-rules.md Markdown 59L · 3.1 KB

├─ ▾ 📁 scripts

│ ├─ ▾ 📁 adapters

│ │ ├─ 🐍 __init__.py Python 21L · 654 B

│ │ ├─ 🐍 base.py Python 103L · 3.9 KB

│ │ ├─ 🐍 ernie.py Python 118L · 4.9 KB

│ │ ├─ 🐍 openai_compat.py Python 91L · 3.8 KB

│ │ └─ 🐍 spark.py Python 143L · 5.4 KB

│ ├─ 🐍 __init__.py Python 14L · 756 B

│ ├─ 🐍 cache.py Python 193L · 6.8 KB

│ ├─ 🐍 classifier.py Python 110L · 4.5 KB

│ ├─ 🐍 config.py Python 91L · 3.1 KB

│ ├─ 🐍 cost_tracker.py Python 211L · 7.1 KB

│ ├─ 🐍 hardware.py Python 109L · 3.9 KB

│ ├─ 🐍 health_check.py Python 181L · 5.8 KB

│ ├─ 🐍 meta.py Python 11L · 491 B

│ ├─ 🐍 mock_engine.py Python 377L · 12.7 KB

│ ├─ 🐍 report.py Python 94L · 4.2 KB

│ ├─ 🐍 router.py Python 883L · 37.7 KB

│ ├─ 🐍 update_check.py Python 92L · 3.2 KB

│ └─ 🐍 yaml_simple.py Python 131L · 3.6 KB

├─ ▾ 📁 tests

│ └─ 🐍 test_router.py Python 466L · 18.6 KB

├─ 📝 SKILL.md Markdown 688L · 39.9 KB

├─ 📋 _core_lock.json JSON 4L · 102 B

├─ 📋 config.example.json JSON 8L · 356 B

└─ 📋 version.json JSON 1L · 436 B

Security positives

核心纯标准库实现（仅讯飞星火可选 websocket-client），无第三方依赖供应链风险

密钥管理规范：仅从环境变量读取，无硬编码、不落盘、不打包

网络请求仅发往各厂商官方域名，无第三方通信

SKILL.md 安全声明完整：无 eval/exec/subprocess/pickle，零风险文件类型

文档结构清晰，功能边界明确（第八节明确列出「不做」的事）

本地 SQLite 数据库（成本/缓存）不上传，数据完全本地化

update_check.py 联网失败静默跳过，不阻塞主流程