ClawHub
Back to skill

Security audit

ModelCLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but normal use can automatically download and run an unpinned remote install script without separate user confirmation.

Install only if you are comfortable with the skill making local system changes and downloading models. Prefer preinstalling ModelCLI from a source you trust, setting MODELCLI_BIN to that executable, and reviewing any install script before allowing automatic bootstrap.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
)
            if download.returncode != 0:
                return None, (download.stderr or download.stdout or "failed to download install.sh").strip()
        result = subprocess.run(
            ["sh", str(script)],
            capture_output=True,
            text=True,
Confidence
96% confidence
Finding
The wrapper executes an install shell script via `sh` after optionally downloading it from a remote URL. This creates a direct remote-code-execution path during normal tool use, because compromise of the source, transport, or repository results in arbitrary code running with the user's privileges.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly instructs the agent to invoke a local Python wrapper and rely on environment/shell execution, but the metadata shown here does not declare corresponding permissions. Undeclared execution capabilities reduce auditability and can cause the skill to perform system-level actions that users or the platform did not clearly authorize, especially because the wrapper may install software and download models.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill claims to use a local ModelCLI, but the wrapper silently expands scope by auto-installing it from a remote install script if missing. This violates least surprise and introduces a high-risk supply-chain/RCE pathway unrelated to the user's immediate inference task.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Network-backed bootstrap followed by shell-script execution materially expands the wrapper's behavior beyond running local model tasks. In an agent setting, this turns a local utility into a code-fetching executor, increasing supply-chain and post-compromise blast radius.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The wrapper always passes `--allow-download`, enabling runtime network retrieval even though the skill is described as operating on local ModelCLI capabilities. This broadens the trust boundary, may trigger unreviewed model downloads, and can cause unexpected data transfer or execution of newly fetched components.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that the wrapper can automatically install ModelCLI and allow missing model downloads during inference, yet it does not require user consent for those network and system-modifying actions. This creates a supply-chain and unexpected-change risk: simply using OCR/ASR/TTS could trigger package installation or remote model retrieval on the host.

Static analysis

No suspicious patterns detected.