AI/ML API LLM + Reasoning for OpenClaw

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:25 PM UTC
• Version: 1.0.1

Overview

This skill is a straightforward AIMLAPI chat-completion helper that sends user-provided prompts and an API key to the expected AIMLAPI endpoint.

Install only if you intend Codex to send prompts, system messages, selected extra JSON fields, and your AIMLAPI API key to AIMLAPI. Use --apikey-file only with a file that contains that API key, avoid sensitive/private prompt content, and choose --output paths carefully because the response JSON will be written there.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tainted flow: 'req' from os.getenv (line 66, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/run_chat.py (reported line 83)May include surrounding context.

python

try:
            if verbose:
                print(f"[debug] POST {url} attempt {attempt + 1}")
            with urllib.request.urlopen(req, timeout=timeout) as response:
                return json.loads(response.read().decode("utf-8"))
        except urllib.error.HTTPError as exc:
            detail = exc.read().decode("utf-8") if exc.fp else str(exc)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes sensitive capabilities via environment access, filesystem read/write, and network access, but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an over-privileged integration boundary where a caller may invoke broader capabilities than intended, increasing the chance of secret exposure, unintended file modification, or arbitrary outbound requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/aimlapi-llm.md (reported line 5)May include surrounding context.

md

import urllib.request
from typing import Any

DEFAULT_BASE_URL = "https://api.aimlapi.com/v1"
DEFAULT_USER_AGENT = "openclaw-skill-aimlapi-llm-reasoning/1.1"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_chat.py (reported line 13)May include surrounding context.

python

import urllib.request
from typing import Any

DEFAULT_BASE_URL = "https://api.aimlapi.com/v1"
DEFAULT_USER_AGENT = "openclaw-skill-aimlapi-llm-reasoning/1.1"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The script reads credentials from AIMLAPI_API_KEY or from a file path supplied by the user. There is no nearby comment, docstring, or user-facing notice explaining that the skill accesses authentication secrets, which is one of the safety-relevant operations covered by this rule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code sends the constructed chat payload, including --user and optional --system content, to a remote API via urlopen. While the CLI description says it runs chat completions, there is no explicit user-facing warning, confirmation, or comment near the transmission point that user-provided content will be sent off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

When --output is provided, the script writes API response data to the specified path. Although it prints after saving, there is no prior disclosure in comments or help text warning that the command will modify a local file, which is the type of operation this rule asks to check.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.