Security audit

AI模型切换器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed model-selection helper with local logging, but it has documentation and functionality quality gaps users should notice before relying on it.

Before installing, treat cloud modes as sending future prompts or documents to the selected external model provider if you manually apply the generated OpenClaw model change. Review or disable local switch logging if shared-machine metadata matters to you, and do not rely on this version for fully automatic switching because the inspected script appears incomplete/manual.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill routes certain tasks to external cloud providers but does not warn users that their task content may leave the local environment and be processed by third parties. Because this skill markets itself around local-vs-cloud switching and cost optimization, users may reasonably assume privacy-sensitive tasks remain local unless clearly told otherwise, increasing the risk of accidental disclosure of confidential data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly states it records detailed usage information, including switch history, token consumption, and cost statistics, but provides no notice about what data is stored, how long it is retained, or whether prompts/task metadata may be included. In a model-routing skill, usage history can reveal sensitive user behavior, topics, and potentially fragments of confidential work, creating a meaningful privacy risk even if the feature is intended for analytics.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The task definitions use broad natural-language descriptions such as '日常聊天、简单问答' and '代码生成、技术问题' without explicit trigger rules, boundaries, or disambiguation logic. In an auto-switching skill, this can cause ambiguous matching and unintended model selection, which may route sensitive, costly, or higher-risk prompts to the wrong model and undermine user expectations around privacy, cost, and capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes automatic switching to cloud models and mentions automatic API endpoint selection, but does not warn users that their prompts, documents, or code may be transmitted to third-party providers. In a model-routing skill, this omission is security-relevant because users may assume all processing is local and unknowingly expose sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented research and long-document workflows encourage processing complex and potentially sensitive materials with cloud models, but give no warning that document contents may be uploaded to external services. Because these modes are explicitly intended for long documents and analysis, the likelihood of exposing confidential internal data, source code, or personal information is higher than for casual chat.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All user-facing help, status, and instructional text shown in the script is written in Chinese, and the file does not indicate that language selection is configurable or intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script persists model-switch history, including timestamps, task labels, and model usage metadata, to local files without clearly informing the user. While not remote code execution, this creates a privacy and confidentiality risk because activity metadata can reveal work patterns, task categories, and cloud/local model usage to other local users or processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Saving token counts, timestamps, cost figures, and last-used data to disk without an explicit warning exposes potentially sensitive operational metadata. In the context of an AI-routing skill, these records may reveal usage intensity, timing, and task behavior, which can be sensitive in shared or managed environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a hybrid solution that 'automatically selects the optimal model' based on task type. However, even after determining a recommended model, the script merely prints openclaw config set model ... and instructs the user to run it manually, so the core advertised behavior is not actually implemented.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline comment 实际切换模型（需要OpenClaw支持） indicates the following code carries out a real switch. In practice, the function only echoes the command and explicitly tells the user to execute it manually, which directly contradicts the comment's stated intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All user-facing documentation in this file is Chinese-only, and there is no indication that the skill supports multiple languages or that Chinese is a required locale for a region-specific use case. This can violate language or locale policy when a specific language is effectively forced without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.