ClawHub
Back to skill

Security audit

Model Alias Append

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it advertises: append model aliases to responses while watching the local OpenClaw config, with no evidence of exfiltration or deceptive behavior.

Install only if you want every hooked response to have a model alias appended. Keep model aliases in your OpenClaw config trusted, since alias text is inserted into responses, and avoid reusing the sample 0.0.0.0 gateway bind on exposed machines unless you intentionally need remote access and have network protections in place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented purpose is passive transparency, but the behavior described by the finding includes persistent modification of ~/.openclaw/openclaw.json and global hook configuration. A skill that silently changes global configuration exceeds user expectations, can alter agent behavior beyond the current session, and may create a stealthy persistence mechanism or response injection surface under the guise of attribution.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The skill invokes a separate local Node.js script to enable or disable hooks via child_process.spawnSync, which expands its capabilities beyond passive response formatting into modifying runtime behavior. While the command path is fixed and there is no obvious direct command injection here, executing helper scripts from a skill increases the attack surface and can be abused if the script, its directory, or the surrounding trust boundary is compromised.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The configuration binds the local gateway to 0.0.0.0, exposing it on all network interfaces rather than limiting it to localhost. For a skill whose purpose is only response alias injection and transparency, this network exposure is unnecessary and increases the attack surface by allowing unintended remote access to the gateway if firewalling or host isolation is weak.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
main.js:253