AI Intelligence Hub - Real-time Model Capability Tracking

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:21 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a model-cost benchmarking helper, but it includes under-disclosed examples and dormant code that can change OpenClaw routing behavior and another skill's configuration.

Review this skill before installing if you rely on stable OpenClaw routing configuration. Its normal commands are local benchmark and recommendation utilities, but do not run the configuration, cron, Slack, budget automation, or compute-router integration snippets unless you are comfortable with model-routing changes, local file writes, and possible sharing of cost information to your webhook destination.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script contains functionality to write a generated configuration into another skill's directory under ~/.openclaw/workspace/skills/compute-router/dynamic_config.json. Even though the function is not wired into the CLI, cross-skill modification is a dangerous capability because it can silently influence routing behavior of a separate component and expand the blast radius beyond benchmark reporting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Reconfiguring an external compute-router is not necessary for a benchmark-reporting utility and creates an unexpected authority boundary crossing. If invoked, this code can alter model tiering, pricing, and task recommendations used elsewhere, enabling integrity issues, misrouting, cost manipulation, or degradation of downstream decision-making.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation instructs users to run a Python script that fetches external benchmark data, caches results locally, and exports files, which implies network, file read, and file write capabilities. However, the manifest declares no explicit permissions or allowed-tools scope, creating a capability/permission mismatch that can lead to overbroad execution or unreviewed access in environments that rely on manifest-scoped trust decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document includes commands that update OpenClaw configuration and later examples that create dashboard files, but the surrounding markdown does not warn users that these examples will modify local configuration or write files to disk. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown presents a curl POST to a Slack webhook containing cost change information, but does not disclose that the example sends data to an external service. For markdown files, network transmission with possible operational data should be accompanied by a warning about privacy and external sharing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/integration-examples.md (reported line 29)May include surrounding context.

md

COST_CHANGES=$(python3 skills/model-benchmarks/scripts/run.py analyze --cost-changes)

if [[ "$COST_CHANGES" != "No significant changes" ]]; then
    curl -X POST -H 'Content-type: application/json' \
        --data "{\"text\":\"🚨 AI Model Cost Alert: $COST_CHANGES\"}" \
        "$SLACK_WEBHOOK_URL"
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This example automatically switches the primary model when spend crosses a threshold, which can materially affect system behavior and user workflows. The markdown describes the automation but does not clearly warn that running it will change configuration automatically based on budget conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code overwrites another skill's configuration file directly and only prints a success message afterward, with no pre-write disclosure, backup, confirmation, or transactional safety. This makes accidental destructive changes more likely and can hide configuration tampering or operational breakage until after the external skill behaves differently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README is predominantly written in English, but the example task labels switch to Chinese at L025-L027. This can amount to an implicit language constraint or inconsistent locale behavior without user opt-in, which falls under the language/locale policy check.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Multiple comments and docstrings in the file are written in Chinese, with no indication that the skill supports alternative languages or that the locale is intentionally region-specific. This can violate a language/locale policy when the skill is otherwise presented in English and gives no user choice or justification for the language constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.