Security audit

ClawAPI Manager

Security checks across malware telemetry and agentic risk

Overview

This skill is broadly aligned with API management, but its handling of API keys, local config changes, alerts, and daemon restarts needs careful review before use.

Install only if you are comfortable giving this skill control over OpenClaw API credentials and configuration. Use a test OpenClaw profile first, avoid pasting production keys into chat or shell history, review generated files for plaintext secrets, disable or carefully configure webhooks/OpenRouter/Telegram alerts, and confirm any model switch or fix operation before applying it to a live deployment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The script logs and sends a 'key has been rotated' success message even though the rotation logic is explicitly unimplemented. This can create false operational assurance, causing operators to believe quota exhaustion or key rollover was handled when no credentials were changed.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The Models table prints provider['api_key'] directly, exposing full API secrets on screen to anyone with terminal access, screenshots, logs, or screen recording visibility. In a configuration-management UI, this is especially risky because operators may reasonably expect secrets to be protected or masked.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The configuration TUI executes an external clawhub command during normal UI rendering, which expands the trust boundary to whatever binary is resolved in the user's PATH. If PATH is manipulated or a malicious clawhub binary/plugin is present, opening the Skills view can trigger unintended code execution under the user's privileges.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The provider listing function returns raw API keys in its output, which is a direct secret disclosure vulnerability. In an agent skill intended for conversational environments like QQ/Feishu, this is especially dangerous because outputs may be shown to end users, logged, forwarded, or stored in chat history, causing credential compromise.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The helper functions claim to encrypt and decrypt values, but when the key file is missing they silently return the original plaintext unchanged. This can cause callers to believe secrets were protected when they were actually stored or transmitted in cleartext, creating a confidentiality failure through misleading behavior.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The connectivity test reads provider.get('baseURL', '') while the rest of the code stores and displays the field as 'baseUrl'. As a result, the test may target an empty or unintended URL, causing false validation results and potentially sending the API key to an unexpected endpoint if malformed data is present.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The script defines a validation step for candidate keys but never calls it before promoting a new key to active status. This can switch production traffic to an invalid, revoked, or misconfigured credential, causing denial of service and potentially masking incident response if operators assume rotation guarantees a working key.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README documents model-switching behavior that explicitly says it will automatically restart a daemon, but it does not clearly warn users about service interruption, transient downtime, or the risk of applying configuration changes to a live deployment. In an agent-management skill, undocumented restarts can disrupt active workloads, break sessions, or cause unexpected operational impact when users follow examples verbatim.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The example command passes an API key directly on the command line (`sk-xxx`), which can leak via shell history, process listings, terminal logs, screenshots, and shared session tooling. Because this skill manages provider credentials, normalizing unsafe credential-entry patterns materially increases the chance of secret compromise and downstream account abuse.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes broad terms such as "cost," "budget," "provider," and "fix config," which can cause the skill to activate in unrelated conversations. Because this skill is capable of validating configs, fixing issues, and handling API keys, accidental invocation could lead to unintended exposure of sensitive configuration details or unreviewed modification workflows.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation advertises automatic config repair and API key updates without warning that these operations modify local files and may process sensitive credentials. In a skill context, that omission increases the risk that users or downstream agents invoke destructive or secret-handling actions without informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The examples explicitly show users pasting API keys and having the assistant add or update them, but they provide no privacy or storage warning. This normalizes sharing secrets directly in chat or commands, which can lead to credential leakage through logs, transcripts, shell history, or improperly protected config files.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script performs outbound network transmission to Telegram without explicit user-facing disclosure or opt-in at runtime. While the sent payload appears limited to alert text rather than raw secrets, this still creates an external data flow channel that operators may not expect, especially in a quota-checking utility.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The list command prints full API keys directly to stdout, which can expose credentials through terminal scrollback, shell history capture, logs, screenshots, remote session recording, or monitoring systems. Because this script manages central server provider credentials, disclosure of these keys could allow unauthorized use of upstream APIs, billing abuse, or access to protected services.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: API keys are displayed unmasked in the TUI without warning or access control. This creates straightforward credential exposure through shoulder surfing, terminal scrollback, shared sessions, screenshots, and support captures.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The models table displays raw API keys directly in the TUI, exposing secrets to anyone with terminal access, screen-sharing visibility, logs, screenshots, or shoulder surfing. In a configuration-management interface, this materially increases the chance of credential theft and downstream unauthorized API usage.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This specific line interpolates p['api_key'] directly into user-visible output, confirming active exposure of sensitive credentials. Anyone able to invoke this helper or inspect its output can recover provider secrets and use them to access paid APIs, impersonate the service, or pivot into other systems.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The encryption path silently falls back to returning plaintext when the master key is absent, without warning the user. In a secrets-management utility, this is especially dangerous because operators may assume sensitive values are encrypted and then store exposed credentials in files, logs, or downstream systems.

Missing User Warnings

High

Confidence: 90% confidence
Finding: The script deletes the original plaintext .env file immediately after encryption without confirmation, backup, or secure handling guidance. This can cause accidental data loss and operational disruption, especially if encryption output is corrupted, misplaced, or the key file is unavailable later.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends the full user-provided task text to OpenRouter without any consent flow, disclosure, redaction, or classification of sensitive content. In an agent skill context, task text may contain secrets, personal data, proprietary prompts, or internal business information, so this creates a real privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The adapter sends an Authorization token to a remote endpoint derived from COPILOT_API_URL without any validation or allowlisting of the destination. If an attacker can influence this environment variable or deployment configuration, they can redirect requests to an attacker-controlled server and capture the API key as well as account usage data.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The health check performs an authenticated request using the same unvalidated api_url, which can leak the API token to an attacker-controlled endpoint even though it appears to be a harmless liveness probe. Because health checks may run automatically and frequently, they can silently exfiltrate credentials with little visibility.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script automatically reads session logs from a hardcoded path in the user's home directory and aggregates activity-derived usage data without any consent prompt, disclosure, or access scoping. While the apparent purpose is legitimate reporting, session logs can contain sensitive metadata about local activity, so silent collection creates a privacy and data-exposure risk, especially if this skill is run by another tool or user who does not expect local files to be inspected.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Webhook URLs, bot tokens, and chat identifiers are stored in a local JSON file in plaintext without any protection or warning. If the host is multi-user, compromised, or the config directory is accidentally committed, these secrets can be stolen and abused to send messages, impersonate the service, or pivot into other connected systems.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script extracts API keys from a user config and writes them in plaintext to an env file, with no permission hardening, no explicit warning, and no validation of the output path. This increases the risk of credential exposure through overly broad file permissions, accidental commits, or writing secrets to an unintended location supplied as the first argument.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.