OpenClaw Model Card

Generate OpenClaw model inventory and model-card images from openclaw.json. Use when asked to list all configured models, verify default/fallback chains, or...

This skill appears to implement exactly what it claims: reading an openclaw.json, performing consistency checks, listing models, and optionally rendering a visual card. Before installing/use: 1) Run it with an explicit --config path to avoid unintentionally reading system/user config files (the script will fallback to OPENCLAW_CONFIG or default paths if --config is omitted). 2) Ensure your environment has python3 and node installed, and install wkhtmltoimage if you want image rendering (md2img.js checks for it). 3) Because the registry metadata lists no required binaries or env vars but the code uses OPENCLAW_CONFIG and external binaries, prefer using explicit paths and avoid exposing sensitive files. 4) If you need higher assurance, review the two included scripts locally (they are short and readable) and run them in a sandboxed environment first. Overall this is internally coherent and not requesting secrets or network access.

Type: OpenClaw Skill Name: openclaw-model-card Version: 0.1.0 The skill bundle is classified as suspicious due to several vulnerabilities in `scripts/show-model-config.py` and `scripts/md2img.js`. The `show-model-config.py` script allows an arbitrary file read via the `--config` argument, enabling an attacker to specify any JSON file on the system for parsing. Additionally, both `show-model-config.py` and `md2img.js` allow an arbitrary file write via the `--image` argument, potentially overwriting existing files or writing to sensitive locations. While there is no evidence of intentional malicious behavior like data exfiltration or persistence, these vulnerabilities could be exploited by an attacker controlling script arguments (e.g., through prompt injection against the agent).