Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed model-recommendation helper that reads a local model registry and checks local Ollama availability, with some privacy and scoping caveats around automatic cloud routing.
Install only if you want OpenClaw to choose models based on task text. Review the registry before enabling auto_route or auto_classify, and prefer local-only settings for private, regulated, credential-bearing, or sensitive prompts because cloud-selected models may process that content outside your machine.
The declared description frames this as generic cloud/local model routing, but the implementation depends on undeclared local resources and only recommends models from a local registry while querying Ollama on localhost. This mismatch can mislead users about what data is accessed and where prompts may be sent, especially when automatic routing may choose cloud-hosted models without an explicit warning.
The skill documents shell-capable behavior (curl, jq, bash routing logic) but does not declare any tool scope or permissions. In an agent environment, undeclared execution capabilities reduce transparency and can cause operators to enable a skill without understanding that it reads local files and interacts with local services.
The activation guidance is broad enough to trigger this skill for many ordinary tasks, increasing the chance that sensitive prompts are routed or evaluated by the skill unnecessarily. In context, that matters because the skill supports cloud/local decision-making and lacks strong warnings about privacy implications of automatic routing.
The keyword-based classifier uses very generic terms like 'help', 'what', 'write', and 'how', which can match routine prompts and cause over-triggering or incorrect routing. In this skill's context, misclassification can expose prompts to cloud-preferred models or produce privacy-impacting decisions without meaningful user intent to route.
The decision tree says the router will check model availability by pinging Ollama and fall back to the next highest candidate if a model is unavailable, and the fallback section further describes a multi-step fallback chain. However, the actual script only classifies the task and prints the top three scored models from the registry; it never performs an availability check or executes fallback selection logic.
The documented scoring rules explicitly include speed preference and host/local privacy preference as factors in the routing decision. In the script, score is computed only from tag and strength matches; host and speed are merely included in output fields and never influence the score, so the behavior contradicts the described routing logic.
The skill promotes automatic routing and lists privacy as a benefit, but it does not clearly warn that prompts may be sent to cloud-hosted models. This can cause unintentional disclosure of sensitive user data, especially when auto-routing is enabled and the default model is cloud-hosted (kimi-k2.6).
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Check if registry exists
if [ ! -f "$REGISTRY" ]; then
echo "Error: Model registry not found at $REGISTRY"
echo "Create one with: cp ~/.openclaw/workspace/skills/model-router/registry.example.json ~/.openclaw/model-registry.json"
exit 1
fi
The strengths list explicitly highlights "chinese" as a preferred capability, which introduces a language-specific attribute in natural-language metadata without any indication of user opt-in or context. Under the policy, language or locale constraints should either offer user choice or be clearly justified as region-specific.
No suspicious patterns detected.