Smart Model Switcher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 3.0.0

Overview

The skill matches its model-switching purpose, but it needs Review because it automatically uses provider API keys, sends requests to multiple external model providers, and documents unpinned or unreviewed install/script paths.

Install only if you are comfortable with your prompts and provider/account checks being sent to the configured model providers. Prefer a pinned, verified release over the documented npx or git clone commands, review any scripts fetched from the repository before running them, and disable or avoid background monitoring unless you understand its polling behavior and cost impact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:27
• Finding: Unpinned Third-Party Installer Execution and Mutable Remote Skill Installation## Vulnerability Details **File Location**: `README.md:27-38`; duplicated in `SKILL.md:328-337` **Vulnerability Type**: Supply-chain exposure through unpinned external installation sources **Risk Level**: Medium ### Vulnerable Code `README.md:27-38`: ```bash #### Method 1: Use ClawHub (recommended) ```bash npx skills add davidme6/openclaw@smart-model-switcher-v3 ``` #### Method 2: Manual installation ```bash # Clone repository git clone https://github.com/davidme6/openclaw.git ``` `SKILL.md:328-337`: ```bash # Clone repository git clone https://github.com/davidme6/openclaw.git # Copy skill into the workspace cp -r openclaw/skills/smart-model-switcher-v3 ~/.openclaw/workspace/skills/ # Or use ClawHub npx skills add davidme6/openclaw@smart-model-switcher-v3 ``` ### Technical Analysis The installation instructions use `npx` without pinning the `skills` package to a specific, verified version. Depending on local npm behavior and cache state, `npx` can retrieve and execute package code from the configured npm registry. The skill identifier and Git repository are also mutable references rather than immutable commit hashes or integrity-verified artifacts. As a result, the content installed by these commands is not guaranteed to match the four files reviewed during this audit. A later repository change, malicious package release, compromised publisher account, compromised upstream repository, or registry-level supply-chain incident could cause users to retrieve and execute unaudited content. The risk is increased by the artifact's references to scripts that are not included in the reviewed package: - `README.md:143-173` references `scripts/runtime-switch.ps1` and `scripts/auto-monitor.ps1`. - `SKILL.md:357` references `scripts/check-availability.js`. Therefore, following the remote installation instructions may introduce executable files that were unavailable for inspection in this audit. ### ...[truncated 1661 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` npm package to an exact audited version instead of invoking an unversioned package: ```bash npx --yes skills@EXACT_AUDITED_VERSION add davidme6/openclaw@smart-model-switcher-v3 ``` 2. Pin the skill source to an immutable release artifact or full Git commit hash rather than a mutable branch or skill alias. 3. Publish and verify a SHA-256 digest or cryptographic signature for every distributed skill archive before installation. 4. Bundle all referenced scripts in the reviewed release so that installed behavior can be audited. Do not advertise absent scripts as implemented functionality. 5. Generate a manifest listing every installed file and its expected digest. Have the installer reject missing, additional, or modified files. 6. Prefer downloading and verifying an artifact before executing any installer. Avoid direct `npx` execution when a verified local installation method is available. 7. Use a locked dependency graph and enable provenance verification for npm packages used during installation. 8. Run installation with a non-privileged account and ensure that the process cannot access unrelated secrets or system-wide directories.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README promotes API key validation and model/package availability checks but does not disclose that these operations will contact third-party provider endpoints using user-supplied credentials. Users may trigger outbound requests without understanding that credential-derived data, metadata, or account information could be transmitted externally.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning a specific version or immutable reference. This can cause users to fetch and execute whatever package/version is current at install time, increasing supply-chain risk if the package is updated maliciously or unexpectedly.

External Transmission

Medium

• Category: Data Exfiltration

Content

"api": "openai-completions"
      },
      "minimax": {
        "baseUrl": "https://api.minimax.chat/v1",
        "apiKey": "sk-minimax-xxx",
        "api": "openai-completions"
      },

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"api": "openai-completions"
      },
      "kimi": {
        "baseUrl": "https://api.moonshot.cn/v1",
        "apiKey": "sk-kimi-xxx",
        "api": "openai-completions"
      }

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to start a background monitoring service without warning that it may continuously poll providers or perform recurring outbound network activity. In a skill that manages multiple model providers, silent background communication can expose usage patterns, incur costs, and expand the attack surface over time.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The description promotes automatic model switching across multiple providers but does not clearly warn users that their prompts, task contents, and possibly sensitive data may be transmitted to multiple third-party APIs. This creates a consent and data-exposure risk, especially because the skill is designed to route requests dynamically across external providers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises automatic API key validation and package/account detection but does not clearly warn that it will read multiple provider credentials and query provider account/package metadata automatically. This can surprise users, trigger unintended outbound requests, and expose account relationships or service entitlements beyond what users expect from a model-switching skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

"api": "openai-completions"
      },
      "minimax": {
        "baseUrl": "https://api.minimax.chat/v1",
        "apiKey": "sk-minimax-xxx",
        "api": "openai-completions"
      },

• Confidence: 90% confidence
• Finding: This configuration references an external MiniMax API endpoint, confirming that user data and prompts may be transmitted off-platform to a third party. External transmission is expected for an LLM provider integration, but in this skill it becomes security-relevant because the skill emphasizes automatic switching and lacks strong upfront warnings and user consent controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

"api": "openai-completions"
      },
      "kimi": {
        "baseUrl": "https://api.moonshot.cn/v1",
        "apiKey": "sk-kimi-xxx",
        "api": "openai-completions"
      }

• Confidence: 90% confidence
• Finding: This configuration references the Kimi/Moonshot external API endpoint, meaning task content may be sent to another third-party provider. While calling a provider API is not inherently malicious, the automatic multi-provider routing context increases the chance of unexpected disclosure of sensitive prompts or metadata.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The installation instruction uses `npx skills add ...` without pinning an exact package version. That allows execution of whatever package/version resolves at install time, increasing supply-chain risk if the package is updated maliciously, hijacked, or unexpectedly changed. In a skill-install context, this is more dangerous because users are encouraged to run the command directly from documentation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations. This README presents all operational guidance in Chinese and does not offer an English alternative, language selection, or any explanation that the skill is intentionally region-specific.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The primary skill documentation and examples are presented almost entirely in Chinese despite the surrounding metadata using English, and there is no statement that users may choose their preferred language. This may conflict with a language/locale policy requiring user choice rather than an implicit default.

Static analysis

No suspicious patterns detected.