T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/manage_models.py:114- Finding
Existing OpenClaw Configuration Can Be Silently Replaced After a Load Failure
- Content
View full analysis
- Remediation
View remediation
Security audit
Global Model Price Finder
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but its enable command persistently changes OpenClaw model configuration and can overwrite existing settings after a config read failure.
Install only if you are comfortable with a model-pricing skill modifying ~/.openclaw/openclaw.json. Use the list function as read-only, and before using enable, make your own backup and inspect the intended config changes because the script can overwrite existing OpenClaw settings if the current config cannot be parsed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents the skill as a simple pricing viewer, but the documented behavior includes modifying ~/.openclaw/openclaw.json, creating backups, and enabling models in local application setup. This mismatch is dangerous because it can mislead users into invoking a skill with side effects they did not expect, which undermines informed consent and can alter local configuration or agent behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises capabilities that include network access and local file modification, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because users and orchestrators cannot easily see that the skill may write to local configuration files and access external services, increasing the chance of unintended or overly broad execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough that the skill may activate in response to generic user requests about models or pricing. In a skill that also performs configuration changes, ambiguous activation increases the risk that a user intending only to inspect prices could be routed into a workflow that proposes or performs local config changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documentation mentions an enable command but does not clearly warn that it modifies a local configuration file. This is dangerous because users may treat the command as a harmless selection action when it actually changes persistent local state, potentially affecting later runs or model routing behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script’s advertised purpose is a simple model pricing viewer, but it also performs task classification and modifies local configuration under ~/.openclaw/openclaw.json. This scope expansion is dangerous because users may grant trust or permissions based on the narrower description, while the hidden write-capable behavior can alter agent/model settings and influence downstream behavior unexpectedly.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The task classification and planning logic is unrelated to a price-finder’s stated function, creating unnecessary capability creep. While it is not directly code-executing or exfiltrating data, such hidden extra behavior increases attack surface and can be used to steer users’ model choices or normalize broader-than-advertised behavior in a supposedly simple utility.
- Content
Static analysis
No suspicious patterns detected.