llm-key-pool

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it handles live LLM API keys and prompt data with weak endpoint and local secret protections that users should review before installing.

Install only if you are comfortable storing provider API keys locally and routing prompts through configured third-party LLM services. Use trusted HTTPS endpoints only, avoid custom or shared configs, set restrictive permissions on llm_config.yaml, never commit or share it, test with non-sensitive prompts, and monitor provider usage or billing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: llm_key_pool/config_loader.py:145

Finding

Unrestricted provider endpoint can disclose API credentials and prompt data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/setup_helper.py:114

Finding

Setup helper stores API credentials without enforcing restrictive file permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (86)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill context increases risk because it explicitly targets multi-vendor API key management and rate-limit avoidance, both of which involve high-value secrets and privileged outbound requests. If the code is actually unrelated, users may still create secret-bearing files and run commands, making the mismatch an effective lure for credential exposure or covert behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill context increases risk because it explicitly targets multi-vendor API key management and rate-limit avoidance, both of which involve high-value secrets and privileged outbound requests. If the code is actually unrelated, users may still create secret-bearing files and run commands, making the mismatch an effective lure for credential exposure or covert behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill context increases risk because it explicitly targets multi-vendor API key management and rate-limit avoidance, both of which involve high-value secrets and privileged outbound requests. If the code is actually unrelated, users may still create secret-bearing files and run commands, making the mismatch an effective lure for credential exposure or covert behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

bash

# 创建 skills 目录（如果不存在）
mkdir -p ~/.claude/skills

# 克隆或复制项目到 skills 目录
git clone https://github.com/OpenClaw/llm-key-pool.git ~/.claude/skills/llm-key-pool

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

bash

# 创建 skills 目录（如果不存在）
mkdir -p ~/.claude/skills

# 克隆或复制项目到 skills 目录
git clone https://github.com/OpenClaw/llm-key-pool.git ~/.claude/skills/llm-key-pool

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly instructs users to place real API keys into a local YAML file and emphasizes convenience, but it does not clearly warn that these credentials are highly sensitive or that prompts and data will be transmitted to third-party model providers. In a key-pooling tool that routes requests across multiple external vendors, this omission increases the chance of accidental credential mishandling and unintended disclosure of sensitive user data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes capabilities that inherently involve reading configuration files, managing sensitive API keys, and making outbound network calls, yet it declares no explicit tool scope or permission boundaries. In an agent environment, this weakens least-privilege controls and can allow broader-than-expected file and network access when handling secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and the entire user-facing markdown content are written in Chinese, and the file does not offer an alternative language option or state that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy for natural-language constraints, this constitutes a locale/language restriction without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide explicitly instructs users to copy a YAML file, edit it, and replace placeholders with real API keys in a local plaintext configuration file that is then consumed by subsequent CLI commands. Although the document briefly says not to commit the file to version control, it does not clearly frame the file as sensitive secret material, recommend safer secret-loading mechanisms, or warn about local exposure risks such as shell history, backups, screenshots, or accidental sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly instructs users to place real API keys directly into a YAML config file, but does not warn about file permissions, secret storage, or accidental commits to version control. In a key-pool skill that encourages multiple third-party credentials, this increases the chance of credential leakage, unauthorized API usage, and billing abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The test commands send user-supplied prompts to external model providers, but the guide does not clearly disclose that entered data leaves the local environment and is transmitted to third-party APIs. Users may unknowingly send sensitive code, internal documents, or regulated data during setup validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quickstart explicitly instructs users to place real API keys into a local YAML file in plaintext, while only later giving a brief generic warning not to commit the file to version control. That guidance does not adequately address local plaintext secret exposure risks such as shell history, backups, shared workstations, accidental file disclosure, or permissive filesystem permissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 171)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/QUICKSTART.md (reported line 33)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/QUICKSTART.md (reported line 73)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config_format.md (reported line 106)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config_format.md (reported line 161)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config_format.md (reported line 301)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/supported_providers.md (reported line 194)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/supported_providers.md (reported line 198)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/supported_providers.md (reported line 520)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/supported_providers.md (reported line 557)May include surrounding context.

md

model: "Qwen/Qwen2.5-7B-Instruct"
    api_keys:
      - "sk-你的真实API-Key"
    base_url: "https://api.siliconflow.cn/v1"

global:
  max_retries: 3

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file's docstring and all user-facing console messages and prompts are written only in Chinese, and the example prompts explicitly direct Chinese output. For a general example script, this imposes a specific language/locale without opt-in, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/INSTALL_GUIDE.md (reported line 61)May include surrounding context.

md

'tier': 'primary',
                'model': 'xiaolongxia-72b',
                'api_keys': [api_key],
                'base_url': 'https://api.xiaolongxia.com/v1'
            }
            print("✓ 小龙虾配置完成")
    print()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/PLATFORM_SETUP_GUIDE.md (reported line 39)May include surrounding context.

md

'tier': 'primary',
                'model': 'xiaolongxia-72b',
                'api_keys': [api_key],
                'base_url': 'https://api.xiaolongxia.com/v1'
            }
            print("✓ 小龙虾配置完成")
    print()

Static analysis

No suspicious patterns detected.