Pcl Publish

• Outcome: Pass
• Latest audit: Sep 22, 2026 · 7:04 AM UTC
• Version: 1.6.0

Overview

This skill is a disclosed OpenClaw UI patch that modifies local Control UI files and adds a browser-side model picker enhancement, with no evidence of external exfiltration or deceptive behavior.

Install only if you want an agent to patch your local OpenClaw Control UI. Review the PowerShell command before running it, expect a local index.html script-tag injection plus an asset copy, and be aware that open tabs may periodically same-origin check for updates and reload. Use the documented -Remove command to uninstall.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 147)May include surrounding context.

md

stock list. The watchdog compares the injected tag against the packaged script (filename
  **and** content fingerprint) and re-runs the installer only when something is missing or
  stale. Registered as the scheduled task `BigLobster-PclModelPickerRepair` (default every
  15 minutes) it heals an upgrade within minutes; the enhancement's own self-update watchdog
  then reloads the open tab, so no manual step is needed.
  - `-Check` (exit `0` healthy / `10` needs repair), `-Repair`, `-Install`, `-Uninstall`,
    `-Status`; log at `%USERPROFILE%\.openclaw\logs\pcl-model-picker-watchdog.log`.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 169)May include surrounding context.

md

### Added

- **Self-update watchdog.** An already-open Control UI tab keeps running the script it
  loaded, so a freshly patched server looked "unpatched" until the user reloaded by hand
  (symptom: click the picker 鈫?still the old layout; refresh 鈫?new layout). The enhancement
  now fetches the app shell (`./`, a network-first path the Service Worker never caches)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The script has undeclared network capability via periodic same-origin fetches used for update detection. Even though it does not exfiltrate data or contact third-party hosts, hidden network behavior expands the trust boundary and can surprise users or bypass expected permission review for a UI-only enhancement.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · CHANGELOG.md (reported line 1)May include surrounding context.

md

# PCL Model Picker — OpenClaw Control UI 增强补丁（幂等）
# 把「左列供应商导航 + 右列该供应商模型」的双列选择器注入 OpenClaw Control UI，
# 并隐藏菜单内官方「此聊天使用的账户」账号控件。
# 重复运行安全；OpenClaw 升级覆盖安装目录后重新运行一次即可恢复。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · pcl-patch.ps1 (reported line 1)May include surrounding context.

text

# PCL Model Picker — OpenClaw Control UI 增强补丁（幂等）
# 把「左列供应商导航 + 右列该供应商模型」的双列选择器注入 OpenClaw Control UI，
# 并隐藏菜单内官方「此聊天使用的账户」账号控件。
# 重复运行安全；OpenClaw 升级覆盖安装目录后重新运行一次即可恢复。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/pcl-patch.ps1 (reported line 1)May include surrounding context.

text

# PCL Model Picker — OpenClaw Control UI 增强补丁（幂等）
# 把「左列供应商导航 + 右列该供应商模型」的双列选择器注入 OpenClaw Control UI，
# 并隐藏菜单内官方「此聊天使用的账户」账号控件。
# 重复运行安全；OpenClaw 升级覆盖安装目录后重新运行一次即可恢复。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · pcl-patch.ps1 (reported line 31)May include surrounding context.

text

$jsName = $jsFile.Name
$marker = 'pcl-model-picker'
# 兼容任意历史版本号（以及带/不带内容指纹）的注入标签，升级脚本时自动原位替换
$tagPattern = '<script defer src="\./assets/pcl-model-picker\.v\d+\.js(\?h=[0-9a-f]{8})?"></script><!-- pcl-model-picker -->'

function Find-ControlUiDir {
    param([string]$Explicit)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/pcl-patch.ps1 (reported line 31)May include surrounding context.

text

$jsName = $jsFile.Name
$marker = 'pcl-model-picker'
# 兼容任意历史版本号（以及带/不带内容指纹）的注入标签，升级脚本时自动原位替换
$tagPattern = '<script defer src="\./assets/pcl-model-picker\.v\d+\.js(\?h=[0-9a-f]{8})?"></script><!-- pcl-model-picker -->'

function Find-ControlUiDir {
    param([string]$Explicit)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This UI enhancer performs periodic fetches of index.html and can automatically reload the page, which exceeds the narrow scope of a model-picker layout tweak. That broader behavior creates availability and trust risks: it can interrupt sessions, discard unsaved UI state, and gives a cosmetic script control over page lifecycle.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic polling and forced reload are not justified by the stated purpose of a model-picker enhancement. In a browser-injected script, this kind of page-control primitive is sensitive because it can be repurposed to repeatedly disrupt use, race user actions, or normalize hidden behavior unrelated to the feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code reloads the page after detecting an update without any user-facing warning, consent, or inline disclosure at the time of action. Silent reload behavior can cause loss of in-progress work and undermines informed user control, especially in a chat UI where users may be composing prompts or changing settings.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs recurring self-update checks by fetching index.html and can trigger location.reload() automatically. Even though this appears intended to keep a UI patch current, it introduces autonomous code/version management behavior that exceeds a simple client-side picker enhancement and creates a control channel where any change to the served page can force client reloads, potentially disrupting sessions or propagating compromised updates more aggressively.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented activation phrase is broad enough that ordinary user requests about improving or fixing the OpenClaw model picker could trigger this skill unintentionally. Because the skill performs installation, repair, and uninstallation actions via PowerShell and modifies Control UI files, accidental activation could lead to unintended system changes rather than a harmless UI response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This file includes a natural-language policy statement that privileges English as the controlling version while providing other languages only for convenience. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern when no justification or user choice is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 58% confidence

Finding

This markdown file contains several language-specific sections (English, Simplified Chinese, Traditional Chinese, Korean, Russian, Japanese, Spanish, French) but does not explicitly state that language selection is optional or user-driven. Because SQP-3 covers natural-language policy violations related to forced language/locale, this could be read as imposing preset locales rather than offering an explicit opt-in mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This PowerShell script's header, usage instructions, thrown errors, and status messages are written in Chinese, which imposes a specific language on users. The file does not offer an alternative language or explain that the skill is intentionally region-specific, so it conflicts with the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.