ClawHub
Back to skill

Security audit

Hudl AI Openclaw Model Switch

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for model switching, but it can persistently change agent configuration and restart OpenClaw from broad or ambiguous prompts, and its gateway validation accepts insecure HTTP.

Review this skill before installing if you do not want chat phrasing to change your default/active OpenClaw model. Use it only with an HTTPS Huddle01 GRU baseUrl, back up your OpenClaw config before switching, avoid the unpinned GitHub fallback unless you trust the current repository state, and prefer explicit model names plus confirmation before restart.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:30
Finding

Unpinned Third-Party Installation and Mutable Source Checkout

Content
View full analysis
Remediation
View remediation
``` 2. Pin Git installations to a full audited commit hash: ```bash git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills" git -C "$tmp_dir/openclaw-skills" checkout --detach ``` 3. Publish SHA-256 checksums or signed release manifests and verify them before copying or executing any files. 4. Prefer signed release tags and verify signatures against a documented maintainer key. 5. Disable or review npm lifecycle scripts where feasible, and avoid global installation when a local, isolated installation is sufficient. 6. Ensure the pinned dependency revision is subjected to the same security review as the skill artifact. 7. Document an explicit update process so dependency upgrades require review rather than silently selecting the latest release. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/validate.sh:42
Finding

Validation Permits Plaintext HTTP for the Credential-Bearing Gateway

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The exact command rm -rf ~/.openclaw/skills/hudl-model-switch is a real hazardous operation because it permanently removes the installed skill directory without backup or confirmation. In the context of an agent skill README that may be followed or executed mechanically, destructive shell commands deserve elevated scrutiny even when path-scoped.

Content

Scanner excerpt · README.md (reported line 90)May include surrounding context.

md
2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`
3) Replace skill folder:
   `rm -rf ~/.openclaw/skills/hudl-model-switch`
   `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch`
4) Ensure script is executable:
   `chmod +x ~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The exact command rm -rf ~/.openclaw/skills/hudl-model-switch is a real hazardous operation because it permanently removes the installed skill directory without backup or confirmation. In the context of an agent skill README that may be followed or executed mechanically, destructive shell commands deserve elevated scrutiny even when path-scoped.

Content

Scanner excerpt · README.md (reported line 90)May include surrounding context.

md
2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`
3) Replace skill folder:
   `rm -rf ~/.openclaw/skills/hudl-model-switch`
   `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch`
4) Ensure script is executable:
   `chmod +x ~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The exact command rm -rf ~/.openclaw/skills/hudl-model-switch is a real hazardous operation because it permanently removes the installed skill directory without backup or confirmation. In the context of an agent skill README that may be followed or executed mechanically, destructive shell commands deserve elevated scrutiny even when path-scoped.

Content

Scanner excerpt · README.md (reported line 90)May include surrounding context.

md
2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`
3) Replace skill folder:
   `rm -rf ~/.openclaw/skills/hudl-model-switch`
   `cp -R "$tmp_dir/openclaw-skills/hudl-model-switch" ~/.openclaw/skills/hudl-model-switch`
4) Ensure script is executable:
   `chmod +x ~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose says this skill should handle requests to switch between LLM models or tell the user which model is currently active. The actual script does neither. Its sole function is preflight validation of the hudl provider configuration in local OpenClaw config files. While this validation is related to the same provider/domain mentioned in the description, it is only a supporting/setup check and not the described primary capability. Therefore the code's actual behavior materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README describes the skill as validating config, editing the OpenClaw config, and restarting the agent automatically, but it does not clearly foreground this as a warning about operational side effects. Users following installation or usage guidance may not appreciate that invoking the skill changes persistent configuration and triggers a service restart, which can disrupt active sessions or alter future agent behavior unexpectedly.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

md
`clawhub install hudl-model-switch`
4) Verify the skill directory exists at `~/.openclaw/skills/hudl-model-switch`
5) Verify required files exist:
   - `~/.openclaw/skills/hudl-model-switch/SKILL.md`
   - `~/.openclaw/skills/hudl-model-switch/scripts/validate.sh`
   - `~/.openclaw/skills/hudl-model-switch/references/models.md`
6) Ensure `validate.sh` is executable; if not, run:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

md
Install `hudl-model-switch` from GitHub and verify it for OpenClaw.

Steps:
1) Create skills directory:
   `mkdir -p ~/.openclaw/skills`
2) Clone repo to temp folder:
   `tmp_dir="$(mktemp -d)" && git clone https://github.com/huddle01/openclaw-skills.git "$tmp_dir/openclaw-skills"`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to delete and replace the existing skill directory with rm -rf ~/.openclaw/skills/hudl-model-switch followed by a copy, but it does not warn that any local modifications or untracked files in that directory will be permanently lost. While scoped to a skill folder rather than arbitrary paths, this is still a destructive operation that can cause unintended data loss during installation or upgrade.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is very broad, including generic phrases like 'use claude', 'upgrade', 'downgrade', 'which model', and 'current model', which can match ordinary conversation outside an explicit configuration-change intent. In an agent environment, accidental invocation can lead to unintended config mutation, service restart, or disclosure of local configuration state, especially because the skill is empowered to run shell commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The alias set for hudl/claude-opus-4.6 includes very broad natural-language phrases such as claude, smart model, advanced, and big model. In a model-switching skill, these vague aliases can cause unintended model selection when users speak imprecisely, leading to routing to a more expensive or different-capability model than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Aliases like flash and flash lite are ambiguous because they overlap semantically across model families and could match user intent imprecisely. In this skill, alias ambiguity directly affects configuration changes, so a user asking for a fast model could be switched to the wrong Gemini tier without explicit confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Aliases such as cheap model, fast model, and default are highly vague and describe preferences rather than a unique model identifier. Because this skill is explicitly triggered by natural-language requests to change models, these aliases can silently force users onto hudl/minimax-m2.5 even when they meant a different inexpensive or default option.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/switch-model.sh (reported line 54)May include surrounding context.

sh
# Check jq is available
if ! command -v jq &>/dev/null; then
  echo "ERROR: jq is required but not installed. Install it with: sudo apt install jq"
  exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/validate.sh (reported line 32)May include surrounding context.

sh
# Check jq is available
if ! command -v jq &>/dev/null; then
  echo "ERROR: jq is required but not installed. Install it with: sudo apt install jq"
  exit 1
fi