Smart Model Router

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 1.1.0

Overview

The skill mostly matches its model-routing purpose, but it uses broad automatic routing instructions and recommends persistent agent behavior changes that users should review carefully.

Install only if you want automatic model routing on routine requests. Do not add the suggested AGENTS.md 'Always follow' line unless you understand it will persist across sessions, and prefer invoking the router with safe argument passing rather than shell-interpolating raw user messages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:28

Finding

Shell Command Injection Through Untrusted User-Message Interpolation

Content

View full analysis

/scripts/router.py --task ""` 2. **Parse JSON** → get `full_id`, `tier`, `confidence` 3. **If `full_id` is `fallback/default`**: do NOT switch. Tell the user to run `--setup`. 4. **If `full_id` differs from current model**: `session_status(model=)` ``` ### Technical Analysis The Skill directs the Agent to interpolate the complete, untrusted user message into a shell command. Double quotes do not prevent shell evaluation of command substitutions such as `$()` or backticks. Embedded quotes can also terminate the intended argument and expose subsequent text to shell parsing. The Python implementation uses `argparse` safely after process creation, but that does not mitigate evaluation performed by a shell before `router.py` starts. Exploitability therefore depends on the Agent implementing this instruction through a shell-based execution tool. This is a realistic execution path because the instruction is presented as a command string rather than an argument-array invocation. Routing only requires passing text to a local Python process. Exposing the message to shell parsing exceeds the minimum privileges necessary for that operation. ### Attack Path 1. An attacker submits a substantive user message containing shell command-substitution syntax or quote-breaking metacharacters. 2. The Agent follows `SKILL.md` and embeds the message in the documented command. 3. The Agent invokes the resulting string through a shell. 4. The shell evaluates attacker-controlled syntax before launching Python. 5. The injected command executes with the same operating-system privileges and filesystem access as the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the Agent's account. Depending on that ...[truncated 575 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:42

Finding

Persistent Global Agent-Control Instruction Recommended Through AGENTS.md

Content

View full analysis

> ~/.openclaw/workspace/AGENTS.md") else: print() print("✅ AGENTS.md already references smart-model-router — auto-routing is active.") ``` ### Technical Analysis The Skill recommends adding an unconditional compliance rule to the persistent `AGENTS.md` instruction file. The setup implementation does not modify that file automatically, but it searches for the rule and prints a ready-to-run command that appends it to the user's global OpenClaw workspace. The proposed rule applies to every substantive request, rather than only requests where the user explicitly enables routing. Once written, it can continue influencing future sessions even if the current setup command has completed or the Skill is no longer desired. This cr ...[truncated 2234 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independently reported description/behavior mismatch indicates the skill writes or reads multiple local files such as models.json, capabilities defaults, and AGENTS.md while claiming to be only a request router. Hidden or underexplained mutation of agent configuration is especially risky because it can persistently alter future agent behavior beyond a single invocation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independently reported description/behavior mismatch indicates the skill writes or reads multiple local files such as models.json, capabilities defaults, and AGENTS.md while claiming to be only a request router. Hidden or underexplained mutation of agent configuration is especially risky because it can persistently alter future agent behavior beyond a single invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is designed to trigger on nearly every substantive user request, which gives it broad influence over normal agent operation. In context, that broad activation is more dangerous because the skill also invokes local scripts and can affect model/session behavior, turning a routing helper into a pervasive interception point.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata says it will switch models on every substantive request via session_status, but this code only returns routing metadata and never performs the promised action. In a security-sensitive routing skill, that mismatch can mislead operators into believing enforcement is active when it is not, causing silent policy bypass or reliance on non-existent controls.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly recommends adding a standing instruction such as 'Always follow smart-model-router SKILL.md instructions' to AGENTS.md. This attempts to elevate the skill's priority and bias the agent toward obeying this skill over other policies or contextual safeguards, which can enable instruction-hijacking and make future malicious or unsafe skill updates more effective.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

bash

# Route a task (after --setup)
python3 <skill_path>/scripts/router.py --task "Write a Python web scraper"

# Debug the scoring
python3 <skill_path>/scripts/router.py --task "Explain quantum entanglement" --debug

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Chinese section repeats the recommendation to add a persistent reminder that strengthens agent compliance with this skill. Repetition in multiple languages broadens reach and increases the chance that operators will configure the agent to privilege this skill's directives, weakening defense-in-depth against prompt/instruction injection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs execution of a local Python script and declares access to a user configuration file, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a transparency and policy gap: the skill can influence file reads/writes and local execution behavior without clear least-privilege constraints, making review and enforcement harder.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Using the ambiguous term 'substantive' without precise decision rules creates unpredictable triggering boundaries. That ambiguity can cause the skill to run on requests users did not expect, increasing the chance of unnecessary script execution, config access, and unintended model/session changes.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/config.py (reported line 212)May include surrounding context.

python

try:
        data = json.loads(Path(path).read_text(encoding="utf-8"))
    except (json.JSONDecodeError, OSError) as exc:
        print(f"[smart-model-router] Warning: cannot read models file {path}: {exc}", file=__import__("sys").stderr)
        return []

    default_cap = {"code": 5.0, "reasoning": 5.0, "agentic": 5.0}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Setup writes models.json directly and can overwrite an existing file without confirmation, backup, or safe-write handling. This can destroy prior configuration or replace intentionally curated routing data, which is especially risky for a skill meant to influence model selection across requests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup path inspects AGENTS.md and prints a command instructing the user to append a persistent routing directive unrelated to the core task of scoring and selecting models. In an agent-skill context, modifying or steering global instruction files can change future agent behavior beyond this skill’s scope, creating an unnecessary trust-boundary crossing and a persistence mechanism for broad influence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README explicitly promotes Chinese-language handling and later claims native bilingual support, but it does not state that language behavior is user-selected or optional. Under the policy rule, locale/language steering should be opt-in or clearly justified; this text suggests a built-in language preference without that clarification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 31% confidence

Finding

This JSON manifest file only contains model metadata and comments, so most policy categories do not apply. The only potentially relevant natural-language concern is the hard-coded provider labeling in comments, but it does not clearly force a user language or locale, so confidence is low.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file defines natural-language routing keywords only for Chinese and English and explicitly labels the library as bilingual. This can create a locale-policy issue because users of other languages are implicitly excluded, and there is no visible opt-in, language selection mechanism, or justification for the restriction in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The module docstring frames the file as a self-contained router with "zero external deps," but _setup depends on external files such as ~/.openclaw/openclaw.json, capabilities_defaults.json, and AGENTS.md, and uses them to shape behavior and user guidance. That documentation materially under-describes and partially contradicts the broader behavior implemented in the same module.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The setup path reads ~/.openclaw/openclaw.json and later probes AGENTS.md locations in the user's home/workspace. These filesystem reads are not accompanied by any explicit user-facing disclosure beyond a narrow docstring, so the skill quietly inspects local configuration and workspace state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.