T09 · Insecure Skill Coding Practices
Error
- Location
src/x402.js:89- Finding
Fabricated Transaction Hashes Are Accepted as Valid Payments
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Smart Router
Security checks for vulnerabilities and agentic risk
Overview
This router mostly matches its stated purpose, but it includes under-controlled payment, local dashboard, and persistent learning features that need careful review before installation.
Install only if you are comfortable with a skill that automatically hooks model requests, keeps local routing and payment history, and exposes a local dashboard. Do not enable wallet/payment use unless you have external spend controls and explicit human approval; avoid exposing port 9093 beyond localhost, and treat the x402 Pro payment flow as not production-safe until transaction verification and wallet ownership checks are fixed.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/x402.js:83- Finding
Payment Requests Are Not Bound to the Wallet Receiving the License
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/dashboard.js:42- Finding
Dashboard APIs Expose Cross-Wallet Data and State Operations Without Authentication
- Content
View full analysis
{ try { const { agent_wallet, timeframe } = req.query; if (!agent_wallet) { return res.status(400).json({ error: 'agent_wallet is required' }); } const router = getSmartRouter(); const stats = await router.getStats(agent_wallet, timeframe || '30 days'); res.json({ success: true, agent_wallet, ...stats }); } catch (error) { console.error('[Dashboard] Error fetching stats:', error); res.status(500).json({ error: error.message, details: process.env.NODE_ENV === 'development' ? error.stack : undefined }); } }); ``` ```js app.get('/api/x402/license/:wallet', (req, res) => { try { const agentWallet = req.params.wallet; if (!agentWallet) { return res.status(400).json({ error: 'wallet address is required' }); } const router = getSmartRouter(); const license = router.checkLicense(agentWallet); res.json({ agent_wallet: agentWallet, ...license, pricing: { pro_monthly: '0.5 USDT/month', features: [ 'Unlimited routing decisions', 'Advanced ML-enhanced routing', 'Custom model preferences', 'Priority support' ] } }); } catch (error) { console.error('[Dashboard] Error checking license:', error); res.status(500).json({ error: error.message, details: process.env.NODE_ENV === 'development' ? error.stack : undefined }); } }); ``` ```js app.listen(port, () => { console.log(` OpenClaw Smart Router - REST API Dashboard`); }); ``` ### ...[truncated 1836 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
src/dashboard.js:158- Finding
Unauthenticated Test Requests Persistently Poison Routing State
- Content
View full analysis
{ try { const { agent_wallet, query } = req.body; if (!agent_wallet) { return res.status(400).json({ error: 'agent_wallet is required' }); } if (!query || typeof query !== 'string') { return res.status(400).json({ error: 'query is required and must be a string' }); } const router = getSmartRouter(); const result = await router.testSelection(query, agent_wallet); res.json({ success: true, query: result.query, task_analysis: result.task_analysis, model_selection: result.model_selection }); } catch (error) { console.error('[Dashboard] Error testing selection:', error); res.status(500).json({ error: error.message, details: process.env.NODE_ENV === 'development' ? error.stack : undefined }); } }); ``` ```js async testSelection(query, agentWallet) { try { const requestData = { prompt: query }; const taskAnalysis = await this.analyzer.analyzeTask(requestData); const modelSelection = await this.selector.selectModel(taskAnalysis, agentWallet); return { query: query, task_analysis: taskAnalysis, model_selection: modelSelection }; } catch (error) { throw new Error(`Failed to test selection: ${error.message}`); } } ``` ```js // Store selection for learning await this.storeSelection(agentWallet, taskAnalysis, selection); ``` ```js async storeSelection(agentWallet, taskAnalysis, selection) { try { const stmt = this.storage.db.prepare(` INSERT INTO routing_decisions ( decision_id, agent_wallet, timestamp, task_complexity, context_length, task_type, ...[truncated 2465 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
src/selector.js:325- Finding
Global Performance Scoring Allows Cross-Agent Routing Contamination
- Content
View full analysis
= datetime('now', '-30 days') `); const stats = stmt.get(model.name, taskType); if (!stats || stats.total === 0) { return 0.6; // Slight positive bias for untested models } // Calculate success rate const successRate = stats.successful / stats.total; // Include quality score if available const qualityScore = stats.avg_quality || 0.7; // Weighted combination return (successRate * 0.6) + (qualityScore * 0.4); } catch (error) { console.error('[ModelSelector] Error scoring performance:', error); return 0.5; // Neutral score on error } } ``` ### Technical Analysis Routing decisions are stored with an `agent_wallet`, and other historical-pattern queries filter by that wallet. In contrast, `scorePerformance()` aggregates every routing decision matching a model and task type, regardless of wallet. The caller's `agentWallet` is not passed into this method. As a result, outcomes generated by one agent affect performance scores used for all other agents. This violates tenant isolation and contradicts the otherwise wallet-scoped learning design. ### Attack Path 1. Generate a large volume of routing outcomes for selected task types and models under an attacker-controlled wallet. 2. Cause the selected model to accumulate favorable or unfavorable success and quality metrics. 3. A victi ...[truncated 781 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (36)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation explicitly states that an agent can autonomously pay for Pro via x402 without human approval, which is a dangerous overreach for a routing utility. Any capability that can trigger financial transactions without informed consent can be abused or misfire, resulting in unauthorized charges and hard-to-reverse asset loss.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that an agent can subscribe and pay without human approval, but it does not describe a warning, confirmation step, or consent gate. This creates a direct risk of unauthorized purchases, especially in autonomous environments where the agent may be induced to justify subscriptions based on manipulated ROI assumptions.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js const promptCost = (promptTokens / 1000) * model.cost_per_1k_prompt; const completionCost = (completionTokens / 1000) * model.cost_per_1k_completion; return promptCost + completionCost; } /**
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The payment verification flow grants Pro access based on a transaction hash that merely has sufficient length, without validating that the transaction exists on-chain or that it paid the correct recipient, amount, token, or chain. An attacker can submit an arbitrary long string as txHash and receive paid features for free, undermining billing enforcement and enabling unauthorized quota/license escalation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The API reference explicitly documents retrieval and storage of historical task patterns tied to an agent identifier, but it does not mention data retention limits, consent, minimization, or privacy controls. Because task analysis can include prompts, context, files, and conversation history, this creates a real risk of persistent storage of sensitive usage metadata or user content without adequate warning or governance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples show database-backed learning through updateSelectionResults and stored routing decisions, which normalizes persistence of token usage, cost, success, quality, and timing metadata without any user-facing warning about retention or privacy implications. In a router that processes user prompts and task history, this can enable silent accumulation of behavioral and potentially sensitive operational data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `incrementDecisionCount(agentWallet)` - Increment usage - `resetDailyQuotaIfNeeded(agentWallet)` - Auto-reset on date change - `getQuota(agentWallet)` - Get full quota info - `initializeQuota(agentWallet)` - Create default quota - `updateAgentTier(agentWallet, tier, paidUntil)` - Update subscription **Payment Methods:**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly describes retrieval and storage of task/request-derived metadata and historical patterns, but gives no warning about retention, visibility, minimization, or consent. In a routing component that processes arbitrary prompts and context, this can lead operators to persist potentially sensitive user content or derived characteristics without realizing the privacy implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The schema and integration sections document persistent database logging of routing decisions, task characteristics, wallet identifiers, outcomes, and learning data, yet omit any privacy warning or operational guidance. This is dangerous because implementers may deploy long-lived logging of sensitive behavioral metadata and identifiers without safeguards, increasing exposure in case of misuse, overcollection, or database compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly says agents can autonomously pay for the Pro tier and that no human approval is needed, but it does not provide an equally prominent warning that this triggers real-money spending. In an agent skill context, encouraging autonomous payment without clear guardrails can lead to unintended purchases, wallet misuse, or abuse if the agent or environment is compromised.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md claw router history --limit=10 # Test complexity analysis claw router analyze "Write a simple hello world function" # Open dashboard claw router dashboard
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that the router intercepts every API request and analyzes task content, but its privacy section only reassures users that data is local and not sent externally. That can understate the sensitivity of prompts, code, secrets, and other request contents being inspected and persisted, increasing the risk that users enable it without informed consent or proper handling of sensitive material.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises capabilities that imply shell, environment, and network access but does not declare any explicit tool scope or permissions boundary. This creates a transparency and containment failure: users and the host may invoke a skill with broader effective powers than expected, increasing the chance of unintended command execution, data access, or outbound communication.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill is presented primarily as a routing optimizer, but it also introduces monetization and subscription/payment behavior that is not central to that purpose. This scope expansion increases risk because users may install a cost-saving router without appreciating that it can also handle paid account actions and related network flows.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Medium (0.3-0.6) → Sonnet: - "Refactor this class to use interfaces" - "Write unit tests for this function" - "Explain how React hooks work" Complex (0.6-0.8) → Opus:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill describes persistent learning from usage patterns and storage of routing memories across sessions, but it does not provide a strong warning about retention, sensitivity of stored prompts/metadata, or user controls. Persisted task patterns can reveal coding tasks, debugging content, research interests, or business context if accessed by other local users or compromised processes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The privacy claims state that routing is local and that there are no external servers or API calls, yet the documented payment and license endpoints indicate networked interactions. Misleading privacy/security statements can cause users to expose queries, wallet identifiers, or usage metadata under false assumptions about locality and telemetry.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The schema persistently stores detailed agent and task telemetry including agent_wallet, task characteristics, routing behavior, model choices, performance, costs, and learned patterns. Even without direct secrets, this creates a rich behavioral dataset that can expose user activity, business-sensitive usage patterns, and potentially deanonymize agents if collected or accessed without clear disclosure, minimization, and access controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The migration comment explicitly describes enabling AI agents to autonomously pay for a Pro tier, which suggests the surrounding feature is designed to initiate payments without clear user opt-in, approval workflow, or policy/locale checks. In an agent skill, autonomous payment capability materially increases financial abuse risk because downstream code may normalize charging behavior as an expected system function.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level CLI description says this tool provides 'Intelligent model selection for OpenClaw agents', which suggests routing/selection functionality. However, the file also exposes license management and a Pro subscription payment flow, including generating payment requests and payment verification instructions, which goes beyond model selection behavior into account monetization.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The subscribe command creates a payment request and instructs the user how to complete and verify a USDT payment over x402. For a skill whose stated purpose is smart routing/model selection, implementing a payment onboarding workflow is a distinct capability that is not obviously required by routing itself.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js console.log('Instructions:\n'); console.log(' 1. Send 0.5 USDT to the recipient address via x402 protocol'); console.log(' 2. After payment, verify with your transaction hash:\n'); console.log(` curl -X POST http://localhost:9093/api/x402/verify \\`); console.log(` -H "Content-Type: application/json" \\`); console.log(` -d '{`); console.log(` "request_id": "${paymentRequest.request_id}",`);
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file-level description says this component is a REST API dashboard for routing operations, but a substantial portion of the code implements subscription billing and license/quota management endpoints. Those payment and entitlement features are materially broader than merely providing dashboard access to routing information and testing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The router includes quota enforcement, license checks, and x402 payment handling, which expands its privileges and attack surface beyond model-routing orchestration. Even if intended as a product feature, combining routing with billing logic increases the risk of unauthorized charging, license abuse, or security flaws in payment flows being reachable through a component that callers may trust as a simple router.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directly exposes payment-related methods such as creating payment requests and verifying blockchain payment transactions, despite its stated purpose being routing. This creates a confused-deputy risk: an agent or caller integrating the skill for routing may unknowingly inherit sensitive financial operations, enabling abuse, unexpected transaction handling, or trust-boundary violations if these methods are invoked without strict authorization controls.
- Content
Static analysis
No suspicious patterns detected.