Openclaw Model Router

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:29 PM UTC
• Version: 2.2.0

Overview

This model-routing skill is coherent and purpose-aligned, but users should keep control over config reads and permanent model-routing changes.

Install this only if you want your agent to inspect configured provider/model names and recommend or apply model-routing changes. Use explicit routing requests, confirm before permanent gateway config.patch changes, and make sure any OpenClaw config view redacts API keys before the agent reads it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The adaptive triggers use short, generic phrases like "normal," "reset," and "save money" without clear scoping to an explicit router command context. In a conversational agent, these phrases can appear incidentally in user prompts or quoted text, causing unintended model-routing changes that alter cost, capability, or behavior for subsequent work.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation assures users that the skill does not read credentials, yet it instructs use of `gateway config.get` or direct config-file reads, which commonly expose full provider configuration including secrets unless carefully scoped. This mismatch can cause accidental secret disclosure to the agent runtime, logs, or downstream tooling even if the author's stated intent is not to inspect keys.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The file says scanning is only user-triggered, but later instructs automatic initialization on first run and automatic rerouting/notification when models are removed. That contradiction weakens user consent boundaries and can lead to unexpected config reads, file writes, or network lookups occurring without an explicit request.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Triggering routing changes or session-level `/model` actions from vague phrases like `normal`, `balanced`, or `default` is unsafe because those words frequently appear in ordinary conversation unrelated to configuration intent. In an agentic environment, ambiguous triggers can cause silent context switches, altered model selection, and unintended cost or quality changes during sensitive work.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill recommends pulling a Docker image via the mutable `latest` tag, which makes the installed artifact non-deterministic and vulnerable to supply-chain surprises if the upstream image changes or is compromised. In a security-sensitive automation context, users may unknowingly run an unreviewed image version that differs from what the skill was validated against.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Quick commands like `Go balanced` and especially `Back to normal` are conversationally common and lack safeguards tying them to an explicit routing-change context. This increases the chance of accidental or prompt-injected activation, leading to unauthorized session model changes or persistent config edits if an implementation follows the examples too literally.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This JSON manifest defines invocation-style routing categories such as "deep-reasoning", "novel-problems", "hard-coding", and "hard-search" without clarifying when they should or should not be used. Several labels are semantically broad and could overlap with many common tasks, increasing the risk of unintended or inconsistent routing.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Labels such as "computer-use", "office-finance", "standard-coding", and "tool-use" are broad categories rather than narrowly defined triggers. Without explicit constraints, different systems or maintainers could interpret them inconsistently, leading to overbroad invocation behavior.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: The markdown explicitly lists example scan triggers, including a generic phrase that a user might say conversationally outside an intent to run this skill. The file does not provide negative examples or stronger scope limits for distinguishing casual discussion from an invocation request.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: Route labels like "drafts", "summaries", "formatting", and "high-volume" are generic task descriptors that can apply to a wide variety of ordinary requests. In a manifest context, this lack of specificity can make routing behavior ambiguous and hard to control.