OpenClaw Session Model Switcher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:47 AM UTC
• Version: 0.1.3

Overview

The skill has a coherent model-switching purpose, but it delegates execution to unaudited workspace scripts and tells the agent to execute returned session commands without strong validation.

Review this before installing. It should only be used where the referenced workspace scripts are trusted, immutable by untrusted users, and known to return only valid /model commands. Prefer a version that bundles its helpers or uses a scoped session-model API instead of executing external scripts and returned commands.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: handler.sh:6

Finding

Execution of Untrusted Out-of-Package Scripts and Unsafe Command Delegation

Content

View full analysis

Vulnerability Details

File Location: handler.sh:6-8, 17, 20, 32-34, 56-62; related delegation instructions in SKILL.md:26-29, 98-102
Vulnerability Type: Trust-boundary violation involving external local tools and unvalidated command delegation
Risk Level: High

Vulnerable Code

bash

WORKSPACE_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
SWITCH_SCRIPT="$WORKSPACE_DIR/scripts/switch-model.sh"
STATUS_SCRIPT="$WORKSPACE_DIR/scripts/model-status.sh"
LIST_SCRIPT="$WORKSPACE_DIR/scripts/list-models.sh"

bash

chmod +x "$SWITCH_SCRIPT" "$STATUS_SCRIPT" "$LIST_SCRIPT"

bash

if [ -n "$FILTER" ]; then
  "$LIST_SCRIPT" "$FILTER"
else
  "$LIST_SCRIPT"
fi

bash

RESOLUTION="$($SWITCH_SCRIPT "$SELECTION")"
STATUS="$(printf '%s' "$RESOLUTION" | node -e 'const fs = require("fs"); const data = JSON.parse(fs.readFileSync(0, "utf8")); process.stdout.write(data.status || "");')"

case "$STATUS" in
  ok)
    COMMAND="$(printf '%s' "$RESOLUTION" | node -e 'const fs = require("fs"); const data = JSON.parse(fs.readFileSync(0, "utf8")); process.stdout.write(data.command || "");')"
    MODEL="$(printf '%s' "$RESOLUTION" | node -e 'const fs = require("fs"); const data = JSON.parse(fs.readFileSync(0, "utf8")); process.stdout.write(data.model || "default");')"

The corresponding upper-layer instructions state:

markdown

- once the script returns a unique model, execute the returned command in the current session

markdown

- `status: ok`
  - execute the returned `command`

Technical Analysis

The handler derives three executable paths from a workspace directory outside the audited skill package. Those scripts are not included in the project, so their implementation and integrity cannot be established by reviewing this package. On every invocation, the handler also applies executable permissions to them and subsequently runs them with the skill's privileges.

Although shell arguments are quoted and there is no direct shell interpola ...[truncated 2696 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle switch-model.sh, model-status.sh, and list-models.sh within the reviewed skill package and resolve them from SCRIPT_DIR, rather than from a mutable workspace-level directory.
2. Remove runtime chmod calls. Set executable permissions during trusted packaging or installation and fail closed if permissions are incorrect.
3. If external scripts are unavoidable, verify canonical paths, file ownership, restrictive permissions, and cryptographic integrity before execution. Reject symlinks and files writable by untrusted users.
4. Do not return free-form executable commands from the resolver. Return structured data such as:

   json

   {
     "status": "ok",
     "operation": "switch_model",
     "provider": "openai",
     "model": "gpt-5.4"
   }
   

5. Invoke a trusted session-model API directly with the validated provider and model identifiers.
6. If command-based integration is required, reconstruct the command in trusted code after strict validation. Permit only /model default or /model <configured-provider/model>, where the provider and model are confirmed against the active configuration.
7. Reject additional arguments, control characters, newlines, command separators, unsupported operations, and malformed JSON.
8. Update SKILL.md so the upper layer never executes a command merely because an external resolver labels its result ok.
9. Add tests covering replaced scripts, symlinks, writable script directories, malicious command fields, newline injection, malformed output, and unsupported model identifiers.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The switch-model trigger phrases are very broad natural-language commands such as 'switch to gpt' and 'use qianwen', which overlap with ordinary user conversation about models. In an agent-skill environment, this can cause unintended activation when the user is merely discussing options rather than explicitly invoking the skill, leading to unauthorized session model changes and potential redirection to weaker, costlier, or less appropriate models.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Restore-default examples like 'restore default model' and especially 'use the default model again' are ambiguous and lack clear scope constraints, so they may match casual dialogue or general troubleshooting requests. Because the skill changes session state, accidental activation can silently revert the user's selected model and disrupt workflow or bypass an intentional temporary model choice.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to invoke shell scripts and execute returned model-switching commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an environment may permit broader shell access than intended, and a malicious or modified script in the referenced path could be run under overly broad privileges.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Status and listing triggers such as 'what model am I using now' and 'what models are available' are common conversational questions and can activate the skill unintentionally during general discussion. While these actions are less dangerous than switching models, they can still cause unintended tool use and expose configuration-derived model inventory that the user did not explicitly request through the skill interface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.