Provider Probe

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 1.0.1

Overview

This provider-auditing skill is not deceptive, but it handles API keys and arbitrary provider URLs without enough guardrails against credential exposure.

Review this skill before installing. Use only least-privilege test API keys, prefer trusted HTTPS provider URLs, avoid passing real keys on the command line, and assume test prompts and metadata may be visible to the provider being probed. It should not be used with production credentials until the transport validation and secret-handling issues are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/provider_probe.py:18

Finding

API Credentials May Be Disclosed Through Plaintext Transport or Unsafe Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/provider_probe.py, lines 18–40
Vulnerability Type: Missing transport and destination validation for sensitive credentials
Risk Level: High

python

def http_call(base_url, api_key, endpoint_kind, model, prompt, timeout=25):
    headers = {
        'Authorization': f'Bearer {api_key}',
        'Content-Type': 'application/json',
        'User-Agent': 'Mozilla/5.0',
    }
    base = base_url.rstrip('/')
    if endpoint_kind == 'responses':
        url = base + '/responses'
        body = {'model': model, 'input': prompt, 'max_output_tokens': 128}
    elif endpoint_kind == 'chat':
        url = base + '/chat/completions'
        body = {'model': model, 'messages': [{'role': 'user', 'content': prompt}], 'max_tokens': 128, 'temperature': 0}
    elif endpoint_kind == 'models':
        url = base + '/models'
        body = None
    else:
        raise ValueError(endpoint_kind)
    data = None if body is None else json.dumps(body).encode()
    req = urllib.request.Request(url, data=data, headers=headers, method='GET' if body is None else 'POST')
    started = time.time()
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:

Technical Analysis

The function unconditionally places the supplied API key in an HTTP Authorization header, but it does not parse or validate base_url before transmitting the credential. In particular, it does not require HTTPS, reject embedded URL credentials, restrict destination ports, or enforce a same-origin redirect policy.

A provider URL using http:// therefore transmits the bearer credential without TLS protection. In addition, urllib.request.urlopen follows supported redirects by default. The implementation does not independently validate each redirect target or explicitly remove authorization information when the destination origin changes. A malicious or compromised provider ma ...[truncated 1724 chars]

Remediation

View remediation

Remediation Suggestions

• Parse base_url with urllib.parse.urlsplit before constructing any request.
• Require the URL scheme to be exactly https.
• Reject URLs containing user information, fragments, malformed hosts, or unexpected schemes.
• Consider restricting ports to an explicit allowlist, such as 443, unless the user deliberately authorizes another TLS port.
• Disable automatic redirects for authenticated requests, or implement a custom redirect handler.
• If redirects are required, permit only HTTPS redirects that preserve the exact original scheme, hostname, and effective port.
• Strip the Authorization header before any cross-origin redirect.
• Validate every redirect destination before issuing the redirected request.
• Add tests covering HTTP URLs, HTTPS-to-HTTP downgrade redirects, cross-host redirects, and same-origin redirects.
• Display a clear error rather than silently attempting a request when URL validation fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Documented Command-Line API Key Submission Exposes Credentials to Local Observation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–62; implemented by scripts/provider_probe.py, line 153
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

bash

Or probe a custom URL directly:
```bash
python3 scripts/provider_probe.py --base-url https://example.com/v1 --api-key sk-xxx --model gpt-5.4

text

The corresponding command-line option is declared as follows:

```python
ap.add_argument('--api-key')

Technical Analysis

The documented direct-probe workflow instructs users to pass the provider API key through the --api-key command-line option. Command-line arguments are not an appropriate secret transport mechanism because they can be recorded or exposed through:

• Shell history files
• Process-listing utilities
• Process accounting and audit systems
• CI/CD job logs
• Terminal recording and support telemetry
• Wrapper scripts or orchestration systems that log executed commands

The script does not warn users about this exposure and does not provide a safer primary mechanism such as a hidden prompt, protected file, or environment-based secret reference.

Attack Path

1. A user follows the documented example and substitutes a real API key for sk-xxx.
2. The shell may save the complete command in its history.
3. While the process is running, another sufficiently authorized local user or monitoring service may inspect its argument vector.
4. CI, task runners, audit systems, or terminal telemetry may retain the complete command after execution.
5. An attacker with access to one of these records obtains the API key.
6. The attacker reuses the credential against the provider API.

Impact Assessment

The exposed credential grants the attacker the same remote API permissions assigned to the key. Potential consequences include unauthorized inference requests, paid-quota consumption, quota ex ...[truncated 338 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key example from the documentation.
• Prefer an interactive secret prompt implemented with getpass.getpass.
• Alternatively, accept a path to a credential file whose permissions are verified before reading.
• If environment variables are supported, document that they may still be exposed by diagnostic tooling and should be injected through an appropriate secret manager.
• Integrate with the existing protected OpenClaw provider configuration rather than requiring the key to be repeated on the command line.
• If backward compatibility requires retaining --api-key, mark it as deprecated and emit a security warning.
• Ensure errors and generated reports never include the credential.
• Add documentation instructing users to rotate any key previously entered into shell history and securely delete or sanitize affected logs where feasible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs use of a probe script that reads provider configuration and performs live network requests, but the skill metadata does not declare any tool scope or permission boundary. That mismatch can cause operators or automated runners to invoke file and network-capable behavior without clear authorization, increasing the risk of unintended config access and outbound probing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the user to supply an API key and probe arbitrary base URLs, but it does not warn that the key, request metadata, and prompt content will be transmitted to third-party infrastructure. In a security-audit context this is especially risky because users may test untrusted providers, leading to credential exposure, logging by unknown services, or accidental disclosure of sensitive prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file says to always report status using mixed Chinese/English phrases such as 当前做到哪了 / what was tested, which imposes a language choice on all outputs. The policy requires avoiding forced language or locale constraints unless the user opted in or the limitation is clearly justified.

Content

No source excerpt is available for this finding.