Diagnose Openclaw Model Routing And Fallback Usage

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

The skill has a legitimate OpenClaw diagnostics purpose, but it recommends broad local searches, external Claude CLI invocation, and unsafe fixed temporary files that users should review before installing.

Install only if you are comfortable with a Chinese-language diagnostic skill that may inspect OpenClaw configs/logs and suggest running local Claude CLI checks. Before following it, narrow searches to explicit project and log paths, approve any Claude CLI invocation, and replace fixed /tmp filenames with a private temporary directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/claudecodecli-exit-code-143-sigterm-reference.md:67

Finding

Overbroad Filesystem Reconnaissance During SIGTERM Diagnosis

Content

View full analysis

/dev/null ``` ### Technical Analysis The diagnostic command recursively searches several broad locations: - System service configuration under `/etc/systemd` - Application and service trees under `/opt` and `/srv` - Matching hidden entries in the invoking user's home directory through `~/.*` These locations may contain unrelated service configurations, operational metadata, usernames, internal paths, and other sensitive information outside the OpenClaw task being diagnosed. Searching all matching hidden home-directory entries is particularly excessive when the relevant project, service name, configuration path, or log path is already known. Redirecting standard error to `/dev/null` also conceals permission failures and inaccessible paths, reducing transparency about the boundaries crossed during the search. The command does not itself bypass operating-system permissions or grant elevated privileges. Its scope is limited to files readable by the invoking account. Nevertheless, it violates least-privilege principles by encouraging access to unrelated files without explicit user authorization. ### Attack Path 1. A user activates the Skill to investigate a ClaudeCodeCLI process that exited with code 143. 2. The Agent follows the reference and executes the broad `rg` command. 3. The command traverses readable content under `/etc/systemd`, `/opt`, `/srv`, and matching hidden home-directory entries. 4. Matching lines from unrelated configurations are returned to the Agent context. 5. Sensitive operational information may consequently be displayed, retained in logs, or included in later diagnostic output. ...[truncated 718 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:142

Finding

Predictable Shared Temporary Files Allow Symlink-Based File Overwrite

Content

View full analysis

/tmp/claude_review_output.txt 2>/tmp/claude_review_error.txt ``` The latter recommendation is repeated in the key code section: ```bash claude -p... > /tmp/claude_review_output.txt 2>/tmp/claude_review_error.txt ``` ### Technical Analysis The filenames are predictable and located directly in the shared `/tmp` directory. On common Unix-like systems, other local users may create entries in `/tmp`. Shell output redirection opens the specified path with truncation and generally follows existing symbolic links. A local attacker who anticipates use of the documented filenames may create one of them as a symbolic link to another file writable by the victim. When the victim follows the Skill, the shell may truncate or overwrite the symlink target with Claude CLI output or error data. The fixed prompt path also creates confidentiality and integrity risks. Another local process may pre-create, replace, or read the prompt file if permissions and creation procedures are not restrictive. Existing `/tmp` protections such as the sticky bit do not, by themselves, prevent symlink-following vulnerabilities. This issue does not independently grant root privileges. The accessible target remains constrained by the permissions of the account running the command. The consequences become more severe if the Skill is invoked by a service account or privileged user with access to sensitive writable files. ### Attack Path 1. An attacker with local access observes or predicts the documented filename `/tmp/claude_review_output.txt`. 2. Before the victim runs the command, the attacker creates a ...[truncated 1176 chars]

Remediation

View remediation

"$prompt_file" claude -p < "$prompt_file" \ > "$output_file" \ 2> "$error_file" ``` For long-running background jobs, retain the private directory only for the required lifetime, record its ownership securely, and remove it after collecting the process status and outputs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

18. **在正式大任务前加最小健康探针**
    - 要做什么：先运行极小命令，例如：
      ```bash
      claude -p "reply with OK"
      ```
    - 验证点：
      - 命令是否可返回

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

md

18. **在正式大任务前加最小健康探针**
    - 要做什么：先运行极小命令，例如：
      ```bash
      claude -p "reply with OK"
      ```
    - 验证点：
      - 命令是否可返回

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

不稳定的调用方式线索

bash

claude -p < /tmp/claude_review_prompt.txt

更稳的结果落盘方式

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and the entire skill instructions are written exclusively in Chinese, and the skill does not state that language should follow user preference or provide any opt-in for locale choice. Per the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a JSON manifest-style file, so vague-trigger checks apply. The file defines a skill name and several example prompts, but it does not specify narrow activation phrases, negative examples, or context constraints that distinguish when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.