Security audit

Model Alias Append

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its model-attribution purpose, but it can persistently change OpenClaw hook settings and append unsanitized config text into outgoing responses.

Review before installing. This skill should only be used if you are comfortable with it intercepting outgoing responses, reading OpenClaw model-alias configuration, and enabling a persistent OpenClaw hook. Prefer a pinned installer version, keep aliases to simple trusted text without Markdown or newlines, and verify how to disable or remove the hook from ~/.openclaw/openclaw.json.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:37
Finding: Unpinned Remote Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation
install model-alias-append ``` 2. Publish and verify an integrity hash or signed release artifact where the package ecosystem supports it. 3. Document the expected registry and trusted package publisher. 4. Review the selected installer version, including its lifecycle scripts and transitive dependencies. 5. Update both `SKILL.md` and `README.md` so users are not directed to execute a mutable package release. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: hooks/response-alias-injector/handler.js:223
Finding: Unsanitized Model Alias Injection into Outgoing Responses
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to execute npx clawhub@latest install model-alias-append, which fetches and runs the latest published package version at install time. Because the version is not pinned, users may execute newly published code that has not been reviewed, increasing supply-chain risk if the package is compromised or a malicious version is published.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The install command uses 'npx clawhub@latest', which pulls whatever version is current at install time rather than a reviewed, fixed release. This creates a supply-chain risk: a malicious or compromised future version could execute arbitrary code during installation or install a materially different skill than the one reviewed here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented purpose is appending model aliases and monitoring config changes, but the implementation also manages hooks that alter external runtime behavior. This hidden capability creates a trust-boundary violation: a seemingly low-risk formatting skill can change system behavior behind the scenes, making review and safe deployment harder and increasing the chance of unexpected persistence or policy bypass.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill launches an external script via child_process to enable or disable a hook, which goes beyond simple response post-processing and introduces code-execution and runtime-mutation behavior. Even though the command arguments are fixed and not obviously user-controlled here, invoking a separate script expands the attack surface and allows the skill to modify surrounding runtime behavior in ways not required for its stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script persistently edits the user's global OpenClaw configuration under ~/.openclaw/openclaw.json, affecting internal hook behavior outside the immediate scope of a single response. Even if intended to support transparency, modifying global config creates cross-session side effects and expands the skill's effective privileges beyond simply appending a model alias.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code enables or disables an internal hook entry persistently without demonstrating that such privileged configuration changes are necessary for the stated attribution purpose. Because the change is written to internal hook configuration, it can silently alter future behavior of the environment and normalize a pattern that could be repurposed for more invasive hook-based persistence.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: main.js:253