ModelSelectorOpenClaw

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:54 PM UTC
• Version: 1.5.3

Overview

This skill clearly discloses that it patches the local OpenClaw Control UI to add a browser-side model picker enhancement, with scoped file changes and an uninstall path.

Install only if you want an agent or shell command to patch your local OpenClaw Control UI files. Review the disclosed changes, keep the generated index.html.bak-pcl backup, and use the documented -Remove command if you want to uninstall. Be aware that open Control UI tabs may poll the same origin and reload after a newer injected picker script is detected.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Self-Modification

High

• Category: Rogue Agent

Content

stock list. The watchdog compares the injected tag against the packaged script (filename
  **and** content fingerprint) and re-runs the installer only when something is missing or
  stale. Registered as the scheduled task `BigLobster-PclModelPickerRepair` (default every
  15 minutes) it heals an upgrade within minutes; the enhancement's own self-update watchdog
  then reloads the open tab, so no manual step is needed.
  - `-Check` (exit `0` healthy / `10` needs repair), `-Repair`, `-Install`, `-Uninstall`,
    `-Status`; log at `%USERPROFILE%\.openclaw\logs\pcl-model-picker-watchdog.log`.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

### Added

- **Self-update watchdog.** An already-open Control UI tab keeps running the script it
  loaded, so a freshly patched server looked "unpatched" until the user reloaded by hand
  (symptom: click the picker 鈫?still the old layout; refresh 鈫?new layout). The enhancement
  now fetches the app shell (`./`, a network-first path the Service Worker never caches)

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The script performs periodic network requests with fetch('./', { cache: 'no-store', credentials: 'same-origin' }) to pull index.html and drive an auto-update/reload mechanism, but the declared permissions apparently do not cover network access. Even though the request is same-origin and used for benign self-update logic, undeclared network capability is security-relevant because it expands the skill's runtime behavior beyond what reviewers and users expect, and a compromised or modified script with this capability could poll or exfiltrate data within the same origin context.

Hidden Instructions

High

• Category: Prompt Injection

Content

# PCL Model Picker — OpenClaw Control UI 增强补丁（幂等）
# 把「左列供应商导航 + 右列该供应商模型」的双列选择器注入 OpenClaw Control UI，
# 并隐藏菜单内官方「此聊天使用的账户」账号控件。
# 重复运行安全；OpenClaw 升级覆盖安装目录后重新运行一次即可恢复。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# PCL Model Picker — OpenClaw Control UI 增强补丁（幂等）
# 把「左列供应商导航 + 右列该供应商模型」的双列选择器注入 OpenClaw Control UI，
# 并隐藏菜单内官方「此聊天使用的账户」账号控件。
# 重复运行安全；OpenClaw 升级覆盖安装目录后重新运行一次即可恢复。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

$jsName = $jsFile.Name
$marker = 'pcl-model-picker'
# 兼容任意历史版本号（以及带/不带内容指纹）的注入标签，升级脚本时自动原位替换
$tagPattern = '<script defer src="\./assets/pcl-model-picker\.v\d+\.js(\?h=[0-9a-f]{8})?"></script><!-- pcl-model-picker -->'

function Find-ControlUiDir {
    param([string]$Explicit)

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script contains a self-update watchdog that periodically fetches same-origin index content, parses build markers, and automatically reloads the page when it detects a changed script fingerprint. For a UI-only model picker enhancement, this introduces autonomous network activity and forced navigation behavior outside the core picker function, creating availability and control risks if the served page is manipulated, unstable, or if reload timing interferes with active user sessions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code performs continuous same-origin polling and can automatically reload the application, which exceeds the stated purpose of a browser-side picker layout enhancement. Even though it targets the same origin, this expands the script's authority from presentation changes into session-affecting behavior, increasing the blast radius of server-side compromise, bad deployments, or logic errors that could cause disruptive reloads or persistent page churn.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script can reload the page automatically after polling for an updated index.html, and it does so without any in-UI notice or user consent. In this skill's context, that can interrupt active work, discard unsaved UI state, and create confusing behavior that looks like the page is acting on its own, especially because the enhancement runs continuously and self-updates.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The header comments and usage guidance are presented entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly flags language or locale constraints when the skill does not offer a user choice or document a justified region-specific limitation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The documentation suggests a very broad natural-language trigger: telling an agent to 'install ModelSelectorOpenClaw for the OpenClaw console' may overlap with ordinary user requests about setup or UI help, causing the skill to activate and run installation actions when the user did not explicitly intend code modification. Because this skill performs local file injection into index.html and copies JS into application assets, an accidental invocation can result in unauthorized system changes rather than a harmless UI response.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: This file applies to SQP-3 because policy-violation checks apply to all file types, including a LICENSE file. The statement that the English text is authoritative establishes a fixed language preference and does not offer a language choice or explain a compliance-based need for that constraint.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The UI string `拖动调整大小（双击复位）` is hard-coded in Chinese, which imposes a specific language on users without offering a locale choice. This is a natural-language policy concern because the skill presents user-facing text in one language regardless of user preference.

Static analysis

No suspicious patterns detected.