Security audit

Model Router Hook

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local model-routing helper that can switch OpenClaw models and store routing memory, with privacy and control considerations but no artifact-backed evidence of malicious behavior.

Install only if you want automatic model switching and local cross-session learning. Review or periodically delete files under ~/.openclaw/workspace/memory/model-router/, avoid using it with sensitive conversations unless local storage is acceptable, and verify the expected OpenClaw CLI/API behavior in your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises code capabilities including environment access, file read/write, and shell-like integration behavior, but declares no permissions or trust boundary information. This creates a capability-transparency gap: users or host systems may invoke a skill with stronger side effects than expected, increasing the risk of unauthorized file access, local persistence, or command execution through the referenced implementation.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill actively executes an external CLI, dynamically imports external tooling, and writes an environment-variable override to influence session model state. In an agent environment, this expands the trust boundary beyond the skill itself and allows hidden side effects on runtime behavior without strong validation, disclosure, or permission checks.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The implementation includes A/B testing, dashboarding, and detailed traceback persistence that materially exceed the manifest's routing-focused description. This hidden functionality increases data collection and retention, creating privacy and information exposure risks because users and operators may not realize interaction metadata and exception details are being stored.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The code creates persistent storage under the user's home directory and, together with the rest of the file, stores cost records and session-derived behavior data beyond the manifest's stated scope. Persisting interaction history, preference signals, and satisfaction metadata can expose sensitive prompts or usage patterns if local files are accessed by other processes or users.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The code claims to 'really execute' model switching, but one fallback path simply sets an environment variable and reports success. This can cause silent mismatch between the recommended and actual model state, undermining auditability and potentially misleading downstream logic that assumes the switch occurred.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation states that the system maintains session memory and global user profiles, but it does not warn users about privacy consequences, retention duration, or how the data may be reused across sessions. This is dangerous because users may disclose sensitive information under the assumption of ephemeral processing when the skill is actually building persistent profiles.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill explicitly documents local file storage for user profiles, session memory, and cost logs, yet it does not present this as a privacy warning or request consent. Writing conversational data to disk can expose sensitive inputs to other local users, backups, endpoint tools, or later compromise if files are not protected.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill invokes an external CLI as part of normal routing without any user-facing warning, approval, or clear platform-level authorization boundary. In agent contexts, undisclosed command execution is dangerous because it can alter session state or interact with the host environment in ways the user did not request or expect.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Writing _OPENCLAW_MODEL_OVERRIDE changes process environment state silently and can influence downstream behavior outside the immediate function. Hidden environment mutation is risky in shared or long-lived agent processes because other components may trust that variable and change execution behavior unexpectedly.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill is designed to learn user preferences and adapt over time, implying retention and profiling across interactions. Persistent behavioral profiling can accumulate sensitive or inferential data without users realizing the scope of collection, especially when combined with routing, budgeting, and conversation analysis.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Maintaining session memory and global user profiles across conversations increases the attack surface for privacy leakage, unintended context carryover, and overcollection. In this skill's context, the feature is core to functionality, but that makes the lack of safeguards more serious because persistent memory is normalized and automatic.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The integration flow instructs the agent to wait for the user's next message and use it for retrospective learning about the prior response. This can repurpose future user input for secondary analysis without a clear boundary or consent, causing unexpected surveillance of follow-up messages and possible capture of unrelated sensitive information.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Automatic on-disk storage of user profiles and session memory is a real privacy and security risk because it persists potentially sensitive conversational data beyond the immediate interaction. In the context of a routing skill, such persistence is not strictly necessary for basic operation, so automatic durable storage without clear safeguards is more dangerous than transient in-memory optimization.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.