Openclaw Model Router

• Outcome: Pass
• Latest audit: May 27, 2026 at 10:22 PM UTC
• Version:
  2.2.0

Overview

This model-routing skill is coherent and disclosed, with manageable risk from broad natural-language model-switch triggers.

Install only if you want the agent to help choose and switch models. Review the trigger phrases, confirm before any permanent gateway config.patch, and check model-registry.json if you want to audit what benchmark and routing data it stores.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase "normal" is too generic for an always-on routing control because it can be invoked unintentionally during ordinary conversation. In a model-routing skill, accidental mode changes can silently alter provider selection, cost, privacy posture, or capability level without clear user intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic model detection, web research, benchmark fetching, and registry updates, but does not clearly disclose that the skill may access the network and modify local files. In a security-sensitive agent environment, undocumented outbound access and persistent state changes reduce user consent and make data exposure or unwanted configuration drift more likely.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The adaptive trigger table includes very broad natural-language phrases such as "use gemini," "use google," "reset," and "back to normal," and some rows instruct the agent to apply session model changes directly. In normal conversation these phrases can appear incidentally or be embedded in untrusted content, creating a prompt-triggered state change risk where the active model is altered without a clearly confirmed user intent.

VirusTotal

61/61 vendors flagged this skill as clean.