ClawHub
Back to skill

Security audit

Configure Openclaw Anyrouter Model And Fix Baseurl

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a legitimate OpenClaw model-routing troubleshooting guide, but it also normalizes persistent edits to another agent's local configuration without clear consent or rollback controls.

Review before installing. Use this only when you intentionally want help changing OpenClaw model routing, and require the agent to show the exact file diff and get confirmation before writing `openclaw.json`, restarting OpenClaw, or touching `~/.claude/settings.json`. Do not allow ClaudeCode settings changes unless you specifically asked to synchronize ClaudeCode.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
92% confidence
Finding

The skill instructs the agent to inspect and modify ~/.claude/settings.json, a user-specific agent configuration file outside the immediate OpenClaw scope. Accessing and rewriting files in another tool’s home-directory config can alter authentication endpoints or model routing globally, potentially redirecting future requests or breaking other workflows.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
10. **检查 ClaudeCode 本地配置，把旧 `fcapp` 地址对齐到 `https://anyrouter.top`。**  
    这样做是为了避免 OpenClaw 已改好，但 ClaudeCode 仍指向旧地址，导致排查结果互相打架。  
    本次已修正 `~/.claude/settings.json` 中相关配置，核心对齐为：
    - `ANTHROPIC_BASE_URL = https://anyrouter.top`
    - 模型变量保持 `claude-opus-4-6`

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

This guidance normalizes ‘顺手检查’ and aligning ~/.claude/settings.json as part of the workflow, which expands the skill from troubleshooting one application into changing another agent’s persistent configuration. In a security context, home-directory agent config access is sensitive because it may contain endpoints, tokens, or settings that affect later autonomous behavior.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
❌ **修复了 OpenClaw 的 `baseUrl`，却忘了 ClaudeCode 仍指向旧网关**  
→ 失败原因：两个入口的配置不一致，会导致排查结论混乱  
✅ **顺手检查 `~/.claude/settings.json` 并对齐 `ANTHROPIC_BASE_URL`**

❌ **用户坚持保留不可用主模型时，不提供可用态恢复方案**  
→ 失败原因：系统会持续报错并依赖隐式 fallback，用户体验差且不透明

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The prerequisites explicitly require read/write access to ~/.claude/settings.json, codifying broad access to a user’s agent configuration directory. Even if operationally motivated, this establishes a capability to read or alter sensitive local config beyond the named target system, which raises the risk of credential exposure, endpoint tampering, or persistence across sessions.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md
- 已安装并可重启的 OpenClaw 环境
- 有权限读取和修改当前 `openclaw.json`
- 有权限查看 OpenClaw 运行日志
- 若需要联动排查，还需可读写 `~/.claude/settings.json`
- 上游 anyrouter 需要提供：
  - 可用 `apiKey`
  - 正确的 `baseUrl`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill’s activation criteria explicitly broaden scope beyond OpenClaw to generic local-agent model routing and troubleshooting tasks. That increases the chance the skill is invoked in unrelated contexts, where it may direct configuration edits, service restarts, and provider changes on systems the user did not intend to modify.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instructions tell the agent to modify configuration state and restart OpenClaw without an explicit safety checkpoint or warning about service interruption, fallback behavior changes, or risk of breaking working credentials. In an automated agent context, this can cause unintended downtime or destructive config drift even if the technical goal is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.