ClawHub
Back to skill

Security audit

model_manager

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but its script can turn a crafted model name into unintended local command execution.

Review before installing. Use only with trusted, simple model IDs shown by the model list, and avoid arbitrary or pasted model strings. The implementation should be changed to call subprocess without a shell and to validate model IDs before this is treated as low-risk.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_cmd(cmd):
    """Run command and return output"""
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True)
        return result.stdout.strip()
    except subprocess.CalledProcessError as e:
        return f"Error: {e.stderr.strip()}"
Confidence
98% confidence
Finding
The code executes shell commands with shell=True, which is dangerous because several callers build the command string using untrusted argv-derived model_id values. An attacker who can influence model_id can inject additional shell syntax and execute arbitrary commands with the privileges of the skill process.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This skill exposes model-management operations by constructing shell command strings and routing user-influenced parameters directly into them. In an agent skill context, this is especially risky because model IDs may come from user instructions or tool-chaining, turning a configuration tool into an arbitrary command-execution primitive.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script performs configuration-changing actions such as setting the active model and adding or removing fallbacks immediately, without any confirmation or safeguard. In a skill environment where the metadata itself says explicit user instruction is required, the absence of in-script enforcement increases the chance of accidental or unauthorized configuration changes.

Static analysis

No suspicious patterns detected.