OpenClaw Model Manager

Fetch and display OpenRouter AI models with pricing and context limits, and configure OpenClaw to use selected models via automatic or fallback settings.

This skill is not clearly malicious, but it has several surprising behaviors you should consider before installing or running it: - Undeclared dependency: The code calls the 'openclaw' CLI (openclaw sessions spawn) but the skill metadata does not list any required binaries. Confirm you have the 'openclaw' binary and understand what 'openclaw sessions spawn' does in your environment. - Broad filesystem access: Utilities (smart_find.py, smart_map.py) and the sub-agent prompts will read and write files in the current directory and under ~/.openclaw. Do not run this in directories containing sensitive data (home, projects with secrets) unless you audit the code and accept the risk. - Sub-agent execution: The optional --execute mode launches sub-agents that receive tasks and prompts to create files and audit code. Those sub-agents may have network access and could transmit data depending on your OpenClaw/OpenRouter configuration. Run initial tests in an isolated environment (container or throwaway VM) and back up ~/.openclaw/openclaw.json first. - Review prompts and code: Inspect prompts.json (it instructs generated agents to use 'write' to create files) and manage_models.py to verify no unexpected network endpoints or data-exfiltration code. The repository includes no hidden remote downloads, which reduces supply-chain risk, but the runtime behavior itself is powerful. If you plan to use this skill: 1) Run it in a safe sandbox first and exercise only 'list' and 'plan' modes without --execute. 2) Back up ~/.openclaw/openclaw.json and any important workspace files. 3) Audit and, if needed, modify the code that spawns sessions to restrict which models/tasks can be launched or to disable automatic execution. 4) Ask the author (or project repo) for clarification about the 'openclaw' CLI dependency and explicit consent flow for spawning sub-agents. If you want, I can produce a short checklist of exact lines to review/change in manage_models.py to limit filesystem or network exposure.

Type: OpenClaw Skill Name: model-manager Version: 1.5.0 The skill exhibits a significant prompt injection vulnerability. User-provided input (`task_description`) is directly embedded into the `--task` argument for `openclaw sessions spawn` in `manage_models.py` and `prompts.json`. This allows a malicious user to potentially manipulate the spawned AI agent's behavior, instructing it to perform unintended actions (e.g., file deletion, data access) by crafting a harmful `task_description`. While the skill's core purpose is benign (model optimization, task orchestration), this vulnerability presents a high-risk attack surface against the OpenClaw agent itself, classifying it as suspicious rather than benign or malicious.