Hudl AI Openclaw Model Switch

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:03 AM UTC
• Version: 1.0.3

Overview

The skill appears purpose-built for model switching, but it can persistently change agent configuration and restart OpenClaw from broad or ambiguous prompts, and its gateway validation accepts insecure HTTP.

Review this skill before installing if you do not want chat phrasing to change your default/active OpenClaw model. Use it only with an HTTPS Huddle01 GRU baseUrl, back up your OpenClaw config before switching, avoid the unpinned GitHub fallback unless you trust the current repository state, and prefer explicit model names plus confirmation before restart.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:30
• Finding: Unpinned Third-Party Installation and Mutable Source Checkout<![CDATA[ ## Vulnerability Details **File Location**: `README.md:30-32`, `README.md:45-48`, and `README.md:81-84` **Vulnerability Type**: Unpinned and unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Clone into your OpenClaw skills directory git clone https://github.com/huddle01/openclaw-skills.git cp -r openclaw-skills/hudl-model-switch ~/.openclaw/skills/hudl-model-switch ``` ```text 2) If not installed, install it: `npm i -g clawhub` 3) Install from ClawHub: `clawhub install hudl-model-switch` ``` ```text 2) Clone repo to temp folder: `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"` 3) Replace skill folder: `rm -rf ~/.openclaw/skills/hudl-model-switch` `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch` ``` ### Technical Analysis The documented installation procedures retrieve mutable third-party content without pinning an exact package version or Git commit. They also do not verify a checksum, digital signature, package provenance, or expected repository revision. The command `npm i -g clawhub` installs the latest package selected by the npm registry and may execute package lifecycle scripts with the permissions of the installing user. Similarly, cloning the repository without a commit or signed tag causes the installation to depend on the repository branch state at execution time. Consequently, the content installed by these instructions can differ from the artifact covered by this audit. This constitutes a supply-chain weakness rather than evidence that the currently reviewed dependency is malicious. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, the package registry path, or the referenced GitHub repository. 2. The attacker publishes or commits a modified installer or skill containing malicious code. 3. A user follows the README prompt and execu ...[truncated 1063 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin ClawHub to an exact reviewed version, for example: ```bash npm install --global clawhub@<reviewed-version> ``` 2. Pin Git installations to a full audited commit hash: ```bash git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills" git -C "$tmp_dir/openclaw-skills" checkout --detach <full-commit-sha> ``` 3. Publish SHA-256 checksums or signed release manifests and verify them before copying or executing any files. 4. Prefer signed release tags and verify signatures against a documented maintainer key. 5. Disable or review npm lifecycle scripts where feasible, and avoid global installation when a local, isolated installation is sufficient. 6. Ensure the pinned dependency revision is subjected to the same security review as the skill artifact. 7. Document an explicit update process so dependency upgrades require review rather than silently selecting the latest release. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/validate.sh:42
• Finding: Validation Permits Plaintext HTTP for the Credential-Bearing Gateway<![CDATA[ ## Vulnerability Details **File Location**: `scripts/validate.sh:42-46` **Vulnerability Type**: Insecure transport validation **Risk Level**: High ### Vulnerable Code ```bash # Check baseUrl matches gru.huddle01.io BASE_URL=$(jq -r '.models.providers.hudl.baseUrl // empty' "$CONFIG") if [[ ! "$BASE_URL" =~ ^(https?://)?gru\.huddle01\.io(/.*)?$ ]]; then echo "ERROR: hudl provider baseUrl is '$BASE_URL', expected host 'gru.huddle01.io'. This skill only works with the Huddle01 GRU gateway." exit 1 fi ``` ### Technical Analysis The regular expression explicitly accepts both `https://` and `http://` through `https?://`; it also accepts a URL without a scheme. This conflicts with the documented secure endpoint, `https://gru.huddle01.io`. The same validation routine checks that the provider contains an API key. If the configuration uses `http://gru.huddle01.io`, validation succeeds and the model-switch workflow can subsequently restart OpenClaw with that configuration. Requests may then transmit the API credential, prompts, model responses, and associated metadata without TLS protection. An on-path attacker could observe plaintext traffic or modify gateway responses. Exploitation depends on the OpenClaw client honoring the accepted HTTP URL and the HTTP endpoint being reachable. ### Attack Path 1. The OpenClaw configuration is created or modified to contain: ```json { "models": { "providers": { "hudl": { "baseUrl": "http://gru.huddle01.io", "apiKey": "sensitive-key" } } } } ``` 2. The user invokes model validation or switching. 3. `validate.sh` accepts the HTTP URL because it matches `(https?://)?`. 4. The switch workflow updates the configuration and instructs OpenClaw to restart. 5. OpenClaw sends gateway requests over plaintext HTTP if the configured endpoint is honored. 6. An attacker positioned on the local network, DNS path, proxy path, or another intermediary net ...[truncated 683 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require an explicit HTTPS URL and reject HTTP or scheme-less values. At minimum, use a strict expression such as: ```bash if [[ ! "$BASE_URL" =~ ^https://gru\.huddle01\.io(/.*)?$ ]]; then echo "ERROR: hudl provider baseUrl must use HTTPS and host gru.huddle01.io." exit 1 fi ``` 2. Prefer structured URL parsing over a regular expression. Validate independently that: - the scheme is exactly `https`; - the hostname is exactly `gru.huddle01.io`; - no username or password component is present; - the port is absent or explicitly approved; - the parsed hostname cannot be confused by user-info or suffix content. 3. Update validation tests to ensure that the following values are rejected: - `http://gru.huddle01.io` - `gru.huddle01.io` - URLs with deceptive user-info or hostname suffixes - unexpected ports 4. Preserve normal TLS certificate and hostname verification in the HTTP client. Do not permit insecure certificate-bypass options. 5. Update error messages and documentation to state that HTTPS is mandatory rather than merely requiring a matching hostname. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`
3) Replace skill folder:
   `rm -rf ~/.openclaw/skills/hudl-model-switch`
   `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch`
4) Ensure script is executable:
   `chmod +x ~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`

• Confidence: 90% confidence
• Finding: The exact command `rm -rf ~/.openclaw/skills/hudl-model-switch` is a real hazardous operation because it permanently removes the installed skill directory without backup or confirmation. In the context of an agent skill README that may be followed or executed mechanically, destructive shell commands deserve elevated scrutiny even when path-scoped.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`
3) Replace skill folder:
   `rm -rf ~/.openclaw/skills/hudl-model-switch`
   `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch`
4) Ensure script is executable:
   `chmod +x ~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`

• Confidence: 88% confidence
• Finding: The exact command `rm -rf ~/.openclaw/skills/hudl-model-switch` is a real hazardous operation because it permanently removes the installed skill directory without backup or confirmation. In the context of an agent skill README that may be followed or executed mechanically, destructive shell commands deserve elevated scrutiny even when path-scoped.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`
3) Replace skill folder:
   `rm -rf ~/.openclaw/skills/hudl-model-switch`
   `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch`
4) Ensure script is executable:
   `chmod +x ~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`

• Confidence: 90% confidence
• Finding: The exact command `rm -rf ~/.openclaw/skills/hudl-model-switch` is a real hazardous operation because it permanently removes the installed skill directory without backup or confirmation. In the context of an agent skill README that may be followed or executed mechanically, destructive shell commands deserve elevated scrutiny even when path-scoped.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose says this skill should handle requests to switch between LLM models or tell the user which model is currently active. The actual script does neither. Its sole function is preflight validation of the hudl provider configuration in local OpenClaw config files. While this validation is related to the same provider/domain mentioned in the description, it is only a supporting/setup check and not the described primary capability. Therefore the code's actual behavior materially differs from the declared purpose.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README describes the skill as validating config, editing the OpenClaw config, and restarting the agent automatically, but it does not clearly foreground this as a warning about operational side effects. Users following installation or usage guidance may not appreciate that invoking the skill changes persistent configuration and triggers a service restart, which can disrupt active sessions or alter future agent behavior unexpectedly.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

`clawhub install hudl-model-switch`
4) Verify the skill directory exists at `~/.openclaw/skills/hudl-model-switch`
5) Verify required files exist:
   - `~/.openclaw/skills/hudl-model-switch/SKILL.md`
   - `~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`
   - `~/.openclaw/skills/hudl-model-switch/references/models.md`
6) Ensure `validate.sh` is executable; if not, run:

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

Install `hudl-model-switch` from GitHub and verify it for OpenClaw.

Steps:
1) Create skills directory:
   `mkdir -p ~/.openclaw/skills`
2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to delete and replace the existing skill directory with `rm -rf ~/.openclaw/skills/hudl-model-switch` followed by a copy, but it does not warn that any local modifications or untracked files in that directory will be permanently lost. While scoped to a skill folder rather than arbitrary paths, this is still a destructive operation that can cause unintended data loss during installation or upgrade.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list is very broad, including generic phrases like 'use claude', 'upgrade', 'downgrade', 'which model', and 'current model', which can match ordinary conversation outside an explicit configuration-change intent. In an agent environment, accidental invocation can lead to unintended config mutation, service restart, or disclosure of local configuration state, especially because the skill is empowered to run shell commands.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The alias set for `hudl/claude-opus-4.6` includes very broad natural-language phrases such as `claude`, `smart model`, `advanced`, and `big model`. In a model-switching skill, these vague aliases can cause unintended model selection when users speak imprecisely, leading to routing to a more expensive or different-capability model than intended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Aliases like `flash` and `flash lite` are ambiguous because they overlap semantically across model families and could match user intent imprecisely. In this skill, alias ambiguity directly affects configuration changes, so a user asking for a fast model could be switched to the wrong Gemini tier without explicit confirmation.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Aliases such as `cheap model`, `fast model`, and `default` are highly vague and describe preferences rather than a unique model identifier. Because this skill is explicitly triggered by natural-language requests to change models, these aliases can silently force users onto `hudl/minimax-m2.5` even when they meant a different inexpensive or default option.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Check jq is available
if ! command -v jq &>/dev/null; then
  echo "ERROR: jq is required but not installed. Install it with: sudo apt install jq"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Check jq is available
if ! command -v jq &>/dev/null; then
  echo "ERROR: jq is required but not installed. Install it with: sudo apt install jq"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.md:90