Diagnose Openclaw Model Routing And Fallback Usage

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

The skill has a legitimate OpenClaw diagnostics purpose, but it recommends broad local searches, external Claude CLI invocation, and unsafe fixed temporary files that users should review before installing.

Install only if you are comfortable with a Chinese-language diagnostic skill that may inspect OpenClaw configs/logs and suggest running local Claude CLI checks. Before following it, narrow searches to explicit project and log paths, approve any Claude CLI invocation, and replace fixed /tmp filenames with a private temporary directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/claudecodecli-exit-code-143-sigterm-reference.md:67
• Finding: Overbroad Filesystem Reconnaissance During SIGTERM Diagnosis<![CDATA[ ## Vulnerability Details **File Location**: `references/claudecodecli-exit-code-143-sigterm-reference.md`, lines 67–76 **Vulnerability Type**: Excessive filesystem access and insufficient least-privilege scoping **Risk Level**: Medium ### Vulnerable Code ```bash rg -n "timeout|RuntimeMaxSec|TimeoutStopSec|SIGTERM|143" /etc/systemd /opt /srv ~/.* 2>/dev/null ``` ### Technical Analysis The diagnostic command recursively searches several broad locations: - System service configuration under `/etc/systemd` - Application and service trees under `/opt` and `/srv` - Matching hidden entries in the invoking user's home directory through `~/.*` These locations may contain unrelated service configurations, operational metadata, usernames, internal paths, and other sensitive information outside the OpenClaw task being diagnosed. Searching all matching hidden home-directory entries is particularly excessive when the relevant project, service name, configuration path, or log path is already known. Redirecting standard error to `/dev/null` also conceals permission failures and inaccessible paths, reducing transparency about the boundaries crossed during the search. The command does not itself bypass operating-system permissions or grant elevated privileges. Its scope is limited to files readable by the invoking account. Nevertheless, it violates least-privilege principles by encouraging access to unrelated files without explicit user authorization. ### Attack Path 1. A user activates the Skill to investigate a ClaudeCodeCLI process that exited with code 143. 2. The Agent follows the reference and executes the broad `rg` command. 3. The command traverses readable content under `/etc/systemd`, `/opt`, `/srv`, and matching hidden home-directory entries. 4. Matching lines from unrelated configurations are returned to the Agent context. 5. Sensitive operational information may consequently be displayed, retained in logs, or included in later diagnostic output. ...[truncated 718 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict searches to the project, service, and log paths explicitly supplied or approved by the user. 2. Determine the relevant service name before reading system service configuration. 3. Request confirmation before searching `/etc`, `/opt`, `/srv`, or hidden home-directory entries. 4. Avoid suppressing all errors by default; report inaccessible locations so the access scope remains transparent. 5. Use narrowly scoped commands, for example: ```bash rg -n "timeout|RuntimeMaxSec|TimeoutStopSec|SIGTERM|143" \ /approved/project/path \ /approved/log/path ``` 6. If systemd inspection is necessary, target a known unit rather than recursively searching all units: ```bash systemctl show approved-service.service \ --property=RuntimeMaxUSec,TimeoutStartUSec,TimeoutStopUSec ``` 7. Treat command output as potentially sensitive and redact unrelated configuration values before including it in a report. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:142
• Finding: Predictable Shared Temporary Files Allow Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 142–153; repeated at lines 276–281 **Vulnerability Type**: Unsafe predictable temporary-file handling **Risk Level**: Medium ### Vulnerable Code The Skill first identifies a fixed prompt path: ```bash claude -p < /tmp/claude_review_prompt.txt ``` It then recommends fixed output and error paths: ```bash claude -p... > /tmp/claude_review_output.txt 2>/tmp/claude_review_error.txt ``` The latter recommendation is repeated in the key code section: ```bash claude -p... > /tmp/claude_review_output.txt 2>/tmp/claude_review_error.txt ``` ### Technical Analysis The filenames are predictable and located directly in the shared `/tmp` directory. On common Unix-like systems, other local users may create entries in `/tmp`. Shell output redirection opens the specified path with truncation and generally follows existing symbolic links. A local attacker who anticipates use of the documented filenames may create one of them as a symbolic link to another file writable by the victim. When the victim follows the Skill, the shell may truncate or overwrite the symlink target with Claude CLI output or error data. The fixed prompt path also creates confidentiality and integrity risks. Another local process may pre-create, replace, or read the prompt file if permissions and creation procedures are not restrictive. Existing `/tmp` protections such as the sticky bit do not, by themselves, prevent symlink-following vulnerabilities. This issue does not independently grant root privileges. The accessible target remains constrained by the permissions of the account running the command. The consequences become more severe if the Skill is invoked by a service account or privileged user with access to sensitive writable files. ### Attack Path 1. An attacker with local access observes or predicts the documented filename `/tmp/claude_review_output.txt`. 2. Before the victim runs the command, the attacker creates a ...[truncated 1176 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a unique private temporary directory with `mktemp -d`. 2. Set a restrictive `umask` before creating prompt, output, or error files. 3. Store all temporary artifacts inside that private directory. 4. Register a cleanup trap so temporary data is removed on normal exit or interruption. 5. Do not use fixed filenames directly under shared `/tmp`. 6. Ensure that files are created by the trusted process rather than accepted if they already exist. 7. Avoid running this workflow as a privileged account unless strictly necessary. A hardened example is: ```bash umask 077 tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/claude-review.XXXXXXXX")" || exit 1 trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM prompt_file="$tmp_dir/prompt.txt" output_file="$tmp_dir/output.txt" error_file="$tmp_dir/error.txt" printf '%s\n' "$review_prompt" > "$prompt_file" claude -p < "$prompt_file" \ > "$output_file" \ 2> "$error_file" ``` For long-running background jobs, retain the private directory only for the required lifetime, record its ownership securely, and remove it after collecting the process status and outputs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

18. **在正式大任务前加最小健康探针**
    - 要做什么：先运行极小命令，例如：
      ```bash
      claude -p "reply with OK"
      ```
    - 验证点：
      - 命令是否可返回

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

18. **在正式大任务前加最小健康探针**
    - 要做什么：先运行极小命令，例如：
      ```bash
      claude -p "reply with OK"
      ```
    - 验证点：
      - 命令是否可返回

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### 不稳定的调用方式线索
```bash
claude -p < /tmp/claude_review_prompt.txt
```

### 更稳的结果落盘方式

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The manifest description and the entire skill instructions are written exclusively in Chinese, and the skill does not state that language should follow user preference or provide any opt-in for locale choice. Per the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: This is a JSON manifest-style file, so vague-trigger checks apply. The file defines a skill name and several example prompts, but it does not specify narrow activation phrases, negative examples, or context constraints that distinguish when the skill should or should not be invoked.

Static analysis

No suspicious patterns detected.