Security audit

API usage optimization

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate cost-saving OpenClaw model-routing skill, but using it can change which providers handle future AI requests.

Install only if you want OpenClaw model routing/fallback help. Before applying generated JSON, review the provider list, replace placeholders, keep the backup, and confirm you are comfortable with future prompts and health checks reaching SiliconFlow, OpenRouter, NVIDIA, DeepSeek, or Zhipu depending on the chosen mode.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script parses a user-supplied --max-price value but never passes it into categorizeModels or the downstream filter functions, so results are always computed against the hardcoded ultraLow threshold. This creates misleading output and can cause users to believe the tool honored their cost bound when it did not, leading to incorrect model selection and unexpected spending.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrases are broad and overlap with common user intents such as asking about free models or cheap configuration, which can cause the skill to activate unexpectedly. Because this skill recommends commands that alter OpenClaw configuration and route traffic to third-party providers, accidental invocation can lead to unintended config changes or exposure to external services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill includes concrete commands that back up config, patch local OpenClaw configuration, and restart the gateway, but the description does not prominently warn that using them changes local state and affects service availability. Users may copy-paste these commands without understanding the operational impact, leading to misconfiguration, disruption, or routing to unintended providers.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The health-check logic performs real outbound POST requests to third-party model APIs and includes bearer tokens plus a test prompt. Even though the prompt is minimal, this still transmits credentials and request metadata to external providers without an explicit warning or opt-in, which can surprise operators and violate least-surprise or data-egress expectations in restricted environments.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/discover.js:51

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/fallback.js:128