ClawHub
Back to skill

Security audit

Model Guard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed model-quota helper that can automatically change the OpenClaw default model, so users should install it only if they want that behavior.

Before installing or scheduling this skill, confirm you are comfortable with it changing your OpenClaw default model automatically. Review guard.js to confirm the candidate models, the 20% threshold, and the fallback model, and prefer running model-guard manually before adding it to cron or heartbeat.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script automatically executes openclaw models set ... to change the active model based on parsed quota data, with no user confirmation, dry-run mode, or clear disclosure that it mutates global configuration. This is dangerous because simply running the skill can silently alter a user's environment and redirect future requests to a different provider/model than expected, affecting cost, behavior, privacy, and trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

In the fallback branch, the script silently switches to google/gemini-3-flash-preview when quota is low, again without consent or warning. This is particularly risky because the fallback crosses from the google-antigravity/ namespace to a different model target, potentially changing service characteristics, data handling expectations, output quality, or billing behavior without the user's knowledge.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description says the skill will "Automatically switch Anti-Gravity models based on quota," but it does not specify when switching occurs, what quota threshold triggers it, or any exclusions. In a manifest file, this broad activation description can lead to unclear or unintended invocation behavior because the trigger conditions are not explicitly bounded.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
guard.js:23