ClawHub
Back to skill

Security audit

model_manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent OpenClaw model manager, but its script can turn a crafted model name into arbitrary local shell command execution.

Review before installing. Only use trusted, exact model IDs, and do not pass model names copied from untrusted text. The publisher should replace shell=True with argument-list subprocess calls, validate model IDs, and add a confirmation or policy check for model-changing commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/model_manager.py:8
Finding

Shell Command Injection Through Unvalidated Model IDs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

This is a tool-parameter abuse issue because the tool exposes a shell execution primitive whose effective behavior is controlled by caller-supplied parameters. In a model-management skill, that is especially risky because user-facing parameters that should only select a model can instead be abused to escape the intended command and execute arbitrary system actions.

Content

Scanner excerpt · scripts/model_manager.py (reported line 10)May include surrounding context.

python
def run_cmd(cmd):
    """Run command and return output"""
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True)
        return result.stdout.strip()
    except subprocess.CalledProcessError as e:
        return f"Error: {e.stderr.strip()}"

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

set_model, add_fallback, and remove_fallback interpolate model_id directly into a shell command string that is later executed by subprocess.run with shell=True. This creates straightforward command injection: a crafted model_id containing characters like ';', '&&', '$()', or backticks could run arbitrary OS commands, not just model-management operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to execute shell commands but does not declare any explicit tool scope such as allowed-tools or permissions. This creates a governance gap: an agent/runtime may permit broader shell use than intended, making it easier for a prompt-influenced invocation path to run commands without clear policy boundaries. Because the skill manages configuration files and model selection, misuse could alter service behavior, increase cost, or disrupt availability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The helper executes arbitrary shell strings with shell=True, which is dangerous because several callers build that string using untrusted model_id input. An attacker who can influence model_id can inject shell metacharacters and execute arbitrary commands with the privileges of the skill process.

Content

Scanner excerpt · scripts/model_manager.py (reported line 10)May include surrounding context.

python
def run_cmd(cmd):
    """Run command and return output"""
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True)
        return result.stdout.strip()
    except subprocess.CalledProcessError as e:
        return f"Error: {e.stderr.strip()}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This skill performs state-changing model operations immediately once invoked, with no in-script confirmation, warning, or policy enforcement. In an agent environment, that increases the chance of unintended configuration changes, especially because the metadata says the skill should only be used after explicit user instruction, but the code itself does not enforce that requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.