by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (automatic model switching) matches its instructions, but the runtime instructions and included scripts imply global/sub-agent model changes and implicit access to a user's OpenClaw config/log paths without declaring them — proceed with caution.
评估建议
This skill is coherent with its stated purpose (automatic multi-modal model switching), but it implicitly expects the ability to affect 'all sessions' and sub-agents and references a user OpenClaw config/log directory that it did not declare as required. If you consider installing:
- Only run the provided scripts after manually inspecting them. They are plain-text PowerShell scripts that will write logs to $env:USERPROFILE\.openclaw and could be executed as a background monitor if you run them...详细分析 ▾
ℹ 用途与能力
The name/description (automatic multi-modal model switching) align with the SKILL.md and the included runtime scripts, which implement task detection and model mapping. However, the scripts reference a user config path ($env:USERPROFILE\.openclaw\openclaw.json) and operate on 'all sessions (main window + sub-agents)', which is broader than the declared registry metadata (which lists no required config paths or special permissions). The implicit expectation that the skill can inspect/affect global agent settings is not declared.
⚠ 指令范围
SKILL.md instructs the agent to perform automatic switching for main window and sub-agents and includes code-like logic for 'all sessions'. The included scripts (PowerShell-formatted .txt files) perform monitoring, write logs to the user's .openclaw directory, and provide a runtime-switch utility that reads a ConfigPath defaulting to the user's OpenClaw config. The skill does not explicitly declare reading/writing those paths or limits on changing other agents' models. That scope (affecting sub-agents and system-wide switching) is broad and not transparently authorized.
✓ 安装机制
There is no install spec and no code files to be compiled or remote archives to download; the skill is instruction-only. This reduces supply-chain risk. Note: the package includes plaintext script files that, if executed by the user/agent, would create/append logs and could be run as a background monitor — but nothing is auto-installed by the registry metadata.
ℹ 凭证需求
The skill declares no required environment variables or credentials (good). Still, the scripts reference the user's HOME-like environment ($env:USERPROFILE) and an OpenClaw config path. Those accesses are plausible for a model-switcher but were not declared as required config paths in the metadata. There are no requests for API keys or secrets — which is appropriate — but the implicit file access should be disclosed.
ℹ 持久化与权限
The skill is not marked always:true and does not request autonomous installation. The SKILL.md describes running an 'auto monitor' background service and provides scripts to start/stop/status that would persist logs under the user's .openclaw directory if executed. Because there's no install spec, persistence only occurs if the agent/user runs those scripts; nevertheless, the skill's instructions encourage running a background monitor that affects model selection across sessions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv6.0.02026/4/3
V6.0.0 类 Trae 模式
● 无害
安装命令
点击复制官方npx clawhub@latest install smart-model-switcher-pro
镜像加速npx clawhub@latest install smart-model-switcher-pro --registry https://cn.longxiaskill.com