AI守门人

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:02 AM UTC
• Version: 1.0.4

Overview

This LLM proxy mostly matches its stated purpose, but its control script can kill unrelated local processes and its advertised safety filtering has bypasses, so it should be reviewed before installation.

Install only if you are comfortable running a local LLM traffic proxy that forwards prompts and API credentials to configured providers. Keep it bound to 127.0.0.1, avoid running the control script as root, inspect the configured port before using start/stop, and do not rely on its safety filter as a security boundary until the PID handling, port-kill behavior, streaming filtering, whitelist logic, and thread limiting are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/llm-proxy.py:371

Finding

Streaming safety filter output is discarded

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/llm-proxy.py:141

Finding

Global whitelist match bypasses all content-filtering rules

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/llm-proxy-ctl.sh:43

Finding

Controller force-kills every process using the configured port

Content

View full analysis

/dev/null) if [ -n "$pids" ]; then echo "🔍 发现占用端口 $port 的进程: $pids" for pid in $pids; do echo " → 终止 PID: $pid" kill -9 "$pid" 2>/dev/null done return 0 fi return 1 } ``` The stop operation invokes this function unconditionally: ```bash # 清理端口进程 echo "🧹 清理端口 $PROXY_PORT..." kill_by_port "$PROXY_PORT" 2>/dev/null sleep 2 ``` The start operation also invokes `kill_by_port` if the health check does not succeed. ### Technical Analysis The controller assumes that every process listening on `PROXY_PORT` belongs to this Skill. It does not verify: - Process ownership. - Executable path. - Command line. - Parent process. - Start time. - Association with the stored proxy PID. The port is configuration-controlled. Therefore, changing `proxy_port` can redirect the destructive process-control behavior toward an unrelated service. The use of unconditional `SIGKILL` also prevents graceful shutdown and cleanup. Killing a service this way can interrupt writes, corrupt state, or leave dependent applications unavailable. Managing unrelated port owners exceeds the minimum privileges necessary to start and stop this proxy. ### Attack Path 1. An attacker or mistaken administrator changes `proxy_port` to the port of another local service. 2. The user runs `llm-proxy-ctl.sh start` or `llm-proxy-ctl.sh stop`. 3. `lsof -ti ":$port"` returns the PID or PIDs associated with that service. 4. The controller sends `SIGKILL` to every returned PID. 5. The unrelated service terminates without an opportunity to shut down safely. The same behavior can occur without malicious configuration when the default pro ...[truncated 495 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/llm-proxy-ctl.sh:11

Finding

Predictable and unvalidated PID file permits arbitrary same-user process termination

Content

View full analysis

> "$LOG_FILE" 2>&1 & echo $! > "$PID_FILE" ``` The stop operation trusts the file contents: ```bash if [ -f "$PID_FILE" ]; then local pid=$(cat "$PID_FILE") echo "🛑 停止守护进程 (PID: $pid)..." kill -9 -- -"$pid" 2>/dev/null || kill -9 "$pid" 2>/dev/null sleep 1 fi ``` ### Technical Analysis The controller stores process identity in a fixed path under the globally shared `/tmp` directory. It does not create the file atomically or verify its ownership, permissions, type, or symlink status. During shutdown, the script does not validate that the file contains only a positive numeric PID or that the referenced process is the expected proxy. It first attempts to kill the process group identified by the negative PID and then falls back to killing the individual PID. A same-user attacker can replace or modify the file between startup and shutdown. PID reuse can also cause an unrelated process to inherit a stale PID after the proxy exits. ### Attack Path 1. An attacker running under the same account writes the PID of a target process to `/tmp/llm-proxy.pid`, or replaces the file with attacker-controlled content. 2. The victim invokes `llm-proxy-ctl.sh stop`. 3. The script reads the untrusted PID without validating process identity. 4. It attempts `kill -9 -- -"$pid"`, potentially targeting an entire process group. 5. If that fails, it executes `kill -9 "$pid"`. 6. The unrelated target process is forcibly terminated. A stale PID file can produce the same result if the operating system reuses the PID for another process. ### Impact Assessment The direct scope is arbitrary process termi ...[truncated 375 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/llm-proxy.py:274

Finding

Configured maximum thread count is not enforced

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (45)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/llm-proxy-ctl.sh (reported line 17)May include surrounding context.

sh

start() {
    # 检查是否已在运行
    if curl -s --max-time 3 "$PROXY_URL" > /dev/null 2>&1; then
        echo "✅ 代理已在运行"
        curl -s "$PROXY_URL" | python3 -m json.tool
        return 0

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/llm-proxy-ctl.sh (reported line 37)May include surrounding context.

sh

echo "✅ 代理 PID: $(cat "$PID_FILE")"

    sleep 3
    if curl -s --max-time 5 "$PROXY_URL" > /dev/null 2>&1; then
        echo "✅ 健康检查通过"
        curl -s "$PROXY_URL" | python3 -m json.tool
    else

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/llm-proxy-ctl.sh (reported line 105)May include surrounding context.

sh

# 清理临时文件
    rm -f "$PID_FILE"
    rm -f /tmp/llm-proxy-wrapper.sh
    echo "✅ 已完全停止"
}

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/llm-proxy-ctl.sh (reported line 110)May include surrounding context.

sh

}

status() {
    if curl -s --max-time 2 "$PROXY_URL" > /dev/null 2>&1; then
        echo "✅ 代理运行中 ($LISTEN_HOST:$PROXY_PORT)"
        curl -s "$PROXY_URL" | python3 -m json.tool
    else

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 21)May include surrounding context.

json

"禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf"
])
# 线程安全的统计

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/llm-proxy.py (reported line 73)May include surrounding context.

python

"禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf"
])
# 线程安全的统计

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

json

"/your-provider": {
  "url": "https://api.your-provider.com/v1",
  "name": "Your Provider",
  "description": "描述信息",
  "pricing": "paid"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 157)May include surrounding context.

json

"/your-provider": {
  "url": "https://api.your-provider.com/v1",
  "name": "Your Provider",
  "description": "描述信息",
  "pricing": "paid"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly documents request logging for proxy traffic but does not warn that proxied prompts, model outputs, and possibly authorization-bearing headers may be written to local log files. For an LLM proxy, this creates a realistic risk of sensitive data exposure because users may assume the service is only forwarding traffic, not persistently storing it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage examples show bearer-token-authenticated API calls sent through the local proxy without warning that all prompts and authentication-bearing traffic traverse the proxy process first. In this skill's context, that omission is security-relevant because operators may route sensitive commercial or personal data through the proxy without understanding the trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 259)May include surrounding context.

OpenAI 兼容格式

bash

curl http://127.0.0.1:18888/openai/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises routing traffic to many third-party LLM providers, but it does not warn users that their prompts, attachments, and model outputs may be transmitted to external services with separate privacy, retention, and training policies. This omission can cause unintended disclosure of sensitive or regulated data, especially because the proxy is designed to simplify sending the same content across multiple providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents that request and service logs are written under ~/.openclaw/logs/llm-proxy/, including request logs, but it does not warn users that prompts and responses may be persisted to disk. This creates a privacy and secret-handling risk because users may send credentials, personal data, or proprietary content through the proxy without understanding that local artifacts remain after use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language metadata and prompt strings require the skill to operate in Chinese, including the description and the LLM review instruction. This is a locale/language constraint, and the file does not indicate any user choice or explicit region-specific justification for enforcing Chinese-only behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 20)May include surrounding context.

json

"关闭杀毒",
    "禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf",
    "关闭防护",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/llm-proxy.py (reported line 72)May include surrounding context.

python

"关闭杀毒",
    "禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf",
    "关闭防护",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 20)May include surrounding context.

json

"关闭杀毒",
    "禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf",
    "关闭防护",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/llm-proxy.py (reported line 72)May include surrounding context.

python

"关闭杀毒",
    "禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf",
    "关闭防护",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 21)May include surrounding context.

json

"禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf",
    "关闭防护",
    "禁用安全",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/llm-proxy.py (reported line 73)May include surrounding context.

python

"禁用杀毒",
    "关闭安全",
    "sudo su",
    "chmod 777",
    "rm -rf",
    "关闭防护",
    "禁用安全",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This JSON config contains user-facing descriptive text and comments predominantly in Chinese, including provider descriptions and annotations. Because no opt-in or alternative locale is indicated in the file, this can be interpreted as a language/locale policy issue if the skill is expected to support users without forcing a specific language.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 49)May include surrounding context.

json

"pricing": "freemium"
    },
    "/groq": {
      "url": "https://api.groq.com/openai/v1",
      "name": "Groq",
      "description": "免费快速推理 (LLaMA, Mixtral等)",
      "pricing": "freemium"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 55)May include surrounding context.

json

"pricing": "freemium"
    },
    "/cloudflare": {
      "url": "https://api.cloudflare.com/client/v4/accounts",
      "name": "Workers AI",
      "description": "免费额度 (10万次/天)",
      "pricing": "freemium"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 61)May include surrounding context.

json

"pricing": "freemium"
    },
    "/deepseek": {
      "url": "https://api.deepseek.com/v1",
      "name": "DeepSeek",
      "description": "新用户免费额度",
      "pricing": "freemium"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/llm-proxy-config.json (reported line 67)May include surrounding context.

json

"pricing": "freemium"
    },
    "/moonshot": {
      "url": "https://api.moonshot.cn/v1",
      "name": "月之暗面",
      "description": "新用户免费额度",
      "pricing": "freemium"

Static analysis

No suspicious patterns detected.