Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Chinese-language guide and helper script for choosing and using open-source LLMs, with disclosed API examples but no hidden execution or persistence behavior.
Before installing, treat this as a Chinese-language LLM selection and API reference. Review any provider privacy terms before using the API examples, avoid sending secrets or sensitive business data to hosted providers or routers, and prefer the local deployment examples when privacy matters.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: opensource-llm-models
description: "开源大模型综合技能 - 覆盖国内外主流开源LLM的选型、部署、调优、API调用。国产: DeepSeek/Qwen/ChatGLM/Yi/MiniMax/Baichuan/Kimi。国际: Llama/Mistral/Gemma/Phi/Falcon/Granite/DBRX"
metadata:
文件标题、描述、示例提示词和整体说明均固定为中文，没有说明这是面向特定中文场景的限定技能，也没有提供其他语言或用户选择。根据语言/区域政策，若技能强制单一语言而无用户选择或明确限定，属于自然语言策略问题。
The skill provides multiple API usage examples that send prompts to third-party model providers, but it does not warn users that their input data will leave the local environment and be processed by external services. In a skill focused on model selection and deployment, this omission can lead users to transmit sensitive prompts, credentials, or proprietary data without informed consent.
This example explicitly configures a client to send chat prompts to DeepSeek's external API endpoint. The external transmission is expected functionality, but without accompanying guidance on data sensitivity, users may unknowingly send confidential information to a third-party service.
import openai
client = openai.OpenAI(
api_key="sk-xxx",
base_url="https://api.deepseek.com/v1",
)
response = client.chat.completions.create(
model="deepseek-chat",
The router example sends data to a third-party aggregation endpoint and advertises one API key for switching across many models, which can widen the data-sharing surface beyond a single provider. In the skill context, this is more dangerous than a single-provider example because users may not know which downstream model or vendor receives their prompts.
# 使用 openclaw-aisa-llm-router 或 asia-llm-router-skills
# 一个API Key 切换70+模型
ROUTER_BASE = "https://api.aisa.com/v1"
client = OpenAI(
api_key="sk-xxx",
The module title and all user-facing strings are written exclusively in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.