Closeli Open Device List Query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.0.3

Overview

The skill does list account devices as advertised, but it can send the account API key to a configurable host and can disable TLS verification, which needs review before installation.

Review before installing. Only use this skill with a least-privilege API key, ensure ~/.openclaw/.env is tightly permissioned, keep AI_GATEWAY_HOST set to the expected trusted Closeli gateway, and do not set AI_GATEWAY_VERIFY_SSL=false with real credentials. Avoid passing the API key through --api-key because command-line arguments may be logged or visible locally.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: list_devices.py:74

Finding

Bearer credential can be transmitted to an unrestricted gateway host

Content

View full analysis

Vulnerability Details

File Location: list_devices.py, lines 74–97
Vulnerability Type: Unrestricted credential destination
Risk Level: High

Vulnerable Code

python

def get_api_host(env_vars):
    """
    获取网关地址：~/.openclaw/.env 中的 AI_GATEWAY_HOST，未配置则用默认值。
    """
    host = env_vars.get("AI_GATEWAY_HOST")
    return host.rstrip("/") if host else DEFAULT_API_HOST


def get_verify_ssl(env_vars):
    """
    判断是否启用 TLS 证书验证。默认启用。
    仅当 ~/.openclaw/.env 中显式设置 AI_GATEWAY_VERIFY_SSL=false 时禁用（仅开发环境）。
    """
    val = env_vars.get("AI_GATEWAY_VERIFY_SSL", "true").lower()
    return val not in ("false", "0", "no")


def call_device_list(api_key, api_host, verify_ssl):
    """
    调用 POST /api/device/list 获取设备列表。

    # Returns
    * dict - 接口返回的完整 JSON 响应
    """
    url = f"{api_host}/api/device/list"
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {api_key}",
    }
    try:
        with httpx.Client(verify=verify_ssl, timeout=120.0, headers=headers) as client:
            resp = client.post(url, content=b"")

Technical Analysis

AI_GATEWAY_HOST is loaded from the shared configuration file and used directly to construct the request URL. The implementation does not validate:

• That the scheme is HTTPS.
• That the hostname is the expected Closeli gateway.
• That the port is approved.
• That the URL excludes embedded user information or other unusual URL components.
• That the destination belongs to an explicit allowlist.

The same request carries AI_GATEWAY_API_KEY in the Authorization header. Consequently, anyone able to alter ~/.openclaw/.env, including another Skill operating under the same user account, can redirect the credential to a server under their control.

This exceeds the minimum privileges required for a device-list Skill. Its documented function requires access to one known API endpoin ...[truncated 1147 chars]

Remediation

View remediation

Remediation Suggestions

• Remove configurable production destinations if the Skill only supports one service.
• Hardcode https://ai-open.icloseli.com as the credential-bearing origin.
• If configurability is necessary, parse the URL with a standards-compliant URL parser and enforce:
  • https as the only permitted scheme.
  • An explicit hostname allowlist.
  • Approved ports only.
  • No embedded username or password.
  • No fragments or unexpected path prefixes.
• Reject IP literals, loopback addresses, link-local addresses, and private-network destinations unless they are explicitly required.
• Configure redirect handling defensively and never forward Authorization headers across origins.
• Store the API key in a per-Skill secret store rather than a shared configuration file.
• Restrict the API key to device-list permission only and rotate any key that may have been exposed.

T09 · Insecure Skill Coding Practices

Error

• Location: list_devices.py:81

Finding

TLS certificate verification can be disabled for credential-bearing requests

Content

View full analysis

Vulnerability Details

File Location: list_devices.py, lines 81–97
Vulnerability Type: Configurable TLS certificate validation bypass
Risk Level: High

Vulnerable Code

python

def get_verify_ssl(env_vars):
    """
    判断是否启用 TLS 证书验证。默认启用。
    仅当 ~/.openclaw/.env 中显式设置 AI_GATEWAY_VERIFY_SSL=false 时禁用（仅开发环境）。
    """
    val = env_vars.get("AI_GATEWAY_VERIFY_SSL", "true").lower()
    return val not in ("false", "0", "no")


def call_device_list(api_key, api_host, verify_ssl):
    """
    调用 POST /api/device/list 获取设备列表。

    # Returns
    * dict - 接口返回的完整 JSON 响应
    """
    url = f"{api_host}/api/device/list"
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {api_key}",
    }
    try:
        with httpx.Client(verify=verify_ssl, timeout=120.0, headers=headers) as client:
            resp = client.post(url, content=b"")

Technical Analysis

Setting AI_GATEWAY_VERIFY_SSL to false, 0, or no causes httpx to skip server-certificate validation. The request still includes the API key in a Bearer authorization header.

When verification is disabled, TLS encryption alone does not authenticate the remote server. A network-positioned attacker can present an arbitrary certificate, impersonate the gateway, terminate the connection, and read both the credential and returned device data.

Although the documentation describes this option as development-only, the code does not technically enforce that restriction.

Attack Path

1. An attacker, compromised Skill, or unsafe deployment changes the shared configuration:

   text

   AI_GATEWAY_VERIFY_SSL=false
   

2. The user runs the device-list Skill.
3. The attacker obtains a network interception position, such as a malicious proxy, compromised router, or hostile local network.
4. The attacker presents a forged certificate for the configured gateway.
5. The cl ...[truncated 634 chars]

Remediation

View remediation

Remediation Suggestions

• Remove support for disabling certificate verification in production code.
• Always initialize httpx.Client with certificate verification enabled.
• For private development certificate authorities, support a specific CA bundle rather than verify=False.
• If an insecure development mode is unavoidable:
  • Require an explicit command-line opt-in rather than a persistent shared setting.
  • Restrict it to loopback test destinations.
  • Reject use with production credentials.
  • Display a prominent warning and require confirmation.
• Consider certificate or public-key pinning where operationally appropriate.
• Rotate credentials used while certificate verification was disabled.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: list_devices.py:38

Finding

Shared credential file is parsed beyond the Skill's required configuration scope

Content

View full analysis

Vulnerability Details

File Location: list_devices.py, lines 38–58
Vulnerability Type: Excessive access to shared secrets
Risk Level: Medium

Vulnerable Code

python

def load_env_file():
    """
    从 ~/.openclaw/.env 文件加载配置。
    这是 OpenClaw 客户端写入的持久化真值源，由所有 skill 共享。
    """
    env_path = Path.home() / ".openclaw" / ".env"
    if not env_path.exists():
        return {}
    result = {}
    try:
        with open(env_path, "r", encoding="utf-8") as f:
            for line in f:
                line = line.strip()
                if not line or line.startswith("#"):
                    continue
                if "=" in line:
                    key, _, value = line.partition("=")
                    key = key.strip()
                    value = value.strip().strip('"').strip("'")
                    result[key] = value
    except Exception as e:
        # 读盘失败时按"未配置"继续，不阻断后续 CLI 参数兜底
        print(f"⚠️ 读取配置文件 {env_path} 失败，将按未配置处理: {e}", file=sys.stderr)
    return result

Technical Analysis

The loader reads every key-value pair in ~/.openclaw/.env into the process dictionary. The Skill only needs:

• AI_GATEWAY_API_KEY
• AI_GATEWAY_HOST
• AI_GATEWAY_VERIFY_SSL

Because the file is shared by all Skills, it may contain credentials unrelated to device listing. Parsing every value unnecessarily copies those unrelated secrets into this process's memory.

There is no evidence that the script intentionally transmits or prints unrelated values. Nevertheless, reading them violates data minimization and least-privilege principles and increases their exposure if the process is inspected, dumped, instrumented, or compromised.

Attack Path

1. Other services or Skills store unrelated credentials in ~/.openclaw/.env.
2. The device-list Skill is invoked.
3. load_env_file() reads every entry and stores all values in env_vars.
4. A debugger, mem ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

• Use a dedicated per-Skill credential store containing only the required API key.
• If the shared file must remain in use, retain only an explicit allowlist:

  python

  allowed = {
      "AI_GATEWAY_API_KEY",
      "AI_GATEWAY_HOST",
      "AI_GATEWAY_VERIFY_SSL",
  }
  if key in allowed:
      result[key] = value
  

• Avoid retaining values after use longer than necessary.
• Enforce restrictive ownership and permissions, such as mode 0600.
• Separate credentials according to service and privilege boundary.
• Grant the API key only device-list query permission.

T09 · Insecure Skill Coding Practices

Warning

• Location: list_devices.py:111

Finding

API key command-line argument can expose credentials to local observers

Content

View full analysis

Vulnerability Details

File Location: list_devices.py, line 111
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--api-key", help="API Key 临时覆盖；持久化请写到 ~/.openclaw/.env")

The documented usage also identifies the command-line argument as a supported delivery method:

markdown

| AI_GATEWAY_API_KEY | `~/.openclaw/.env` (persistent, written by OpenClaw clients), command line `--api-key` (temporary override) | API key used for API authentication. CLI flag takes precedence over the file when both present |

Technical Analysis

Command-line arguments are not an appropriate secret-delivery mechanism. Depending on the operating system, shell, process supervisor, and logging configuration, an API key supplied through --api-key may appear in:

• Shell history.
• Process listings and process inspection interfaces.
• Audit logs.
• Job-control metadata.
• Agent execution traces.
• Monitoring or debugging output.

The argument is described as temporary, but temporary use does not prevent these secondary copies from persisting.

Attack Path

1. A user invokes:

   bash

   python3 list_devices.py --api-key SECRET_VALUE
   

2. The shell records the command or a local observer reads the process arguments while it is running.
3. The observer extracts SECRET_VALUE.
4. The observer authenticates to the gateway with the captured key.

Impact Assessment

A local user or monitoring component with access to command histories, process metadata, or execution logs can obtain the API key. The resulting remote privileges are equivalent to all permissions assigned to that key.

The issue does not directly elevate local privileges; it discloses an account credential to principals that can inspect command execution.

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key command-line option.
• Obtain credentials from a protected per-Skill secret store.
• For nonpersistent delivery, read the secret from standard input without echo, a pre-opened file descriptor, or an operating-system credential API.
• Ensure secrets are redacted from agent logs, telemetry, exception reports, and process-supervisor configuration.
• Rotate keys that have previously been supplied through command-line arguments if execution history may be accessible.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:38

Finding

Third-party dependency installation guidance is unpinned and lacks integrity verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 38
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Instruction

markdown

The script depends on httpx. If it is not installed, the script will prompt `python3 -m pip install httpx`.

The implementation emits the same unpinned installation command when the import fails:

python

try:
    import httpx
except ImportError:
    print("❌ 缺少依赖 httpx，请先安装：python3 -m pip install httpx", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation command resolves the latest package version available from the user's configured Python package index. It does not specify:

• An approved version.
• A cryptographic package hash.
• A lock file.
• A trusted package index.
• A reproducible environment.

The package name httpx is legitimate and there is no evidence that the Skill installs a deliberately malicious or misspelled dependency. The risk is that installation behavior can change over time or be influenced by a compromised or attacker-controlled package index.

The script does not automatically execute pip; user action is required.

Attack Path

1. httpx is absent from the environment.
2. The user follows the displayed installation command.
3. The configured package index, mirror, DNS path, or upstream package distribution is compromised.
4. pip downloads and installs a malicious or unauthorized package release.
5. The malicious dependency executes when imported by list_devices.py.
6. It can access the API key and all other data available to the Python process.

Impact Assessment

A compromised dependency executes with the operating-system privileges of the user running the Skill. It could read local files available to that user, capture gateway credentials, alter API responses, or make arbitrary network requests.

The practical likelihood is redu ...[truncated 148 chars]

Remediation

View remediation

Remediation Suggestions

• Declare an reviewed, exact dependency version in a requirements or lock file.
• Include trusted cryptographic hashes and install with hash enforcement, for example:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Use a controlled package index and explicitly configure the approved index URL.
• Install dependencies in an isolated virtual environment.
• Add automated dependency vulnerability and provenance scanning.
• Review and update pinned versions through a controlled maintenance process.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is narrower than the described behavior: it allows command-line API key override, configurable host selection, optional TLS verification disablement, and may return more data than the declared minimal device fields. This mismatch is dangerous because reviewers and users may trust the short description while the actual behavior enables credential substitution, redirection to attacker-controlled endpoints, or exposure of broader account data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill is explicitly designed to read an API key from a shared plaintext credential file used by multiple skills. Any skill with file-read access under the same user context can potentially access that secret, so compromise of one skill can cascade into unauthorized API use and account data exposure.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

openclaw:
    requires:
      bins: ["python3"]
      configPaths: ["~/.openclaw/.env"]
    primaryEnv: "AI_GATEWAY_API_KEY"
---

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

`POST /api/device/list` is used to query all devices bound to the currently authenticated user. This API does not require a request body. The device list is automatically associated through the api_key.

## ⚠️ Display Rules (MUST Be Strictly Followed)

The script outputs structured data in JSON format, which is the expected behavior. The following display rules are formatting instructions for the agent: the agent MUST parse the JSON output from the script and convert it into a user-friendly format according to the rules below before displaying it, and MUST NOT display the raw JSON directly.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

## ⚠️ Display Rules (MUST Be Strictly Followed)

The script outputs structured data in JSON format, which is the expected behavior. The following display rules are formatting instructions for the agent: the agent MUST parse the JSON output from the script and convert it into a user-friendly format according to the rules below before displaying it, and MUST NOT display the raw JSON directly.

1. When `code == 0` and `data` is not empty, display it as a table:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 10)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 11)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 39)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 67)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 76)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 85)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 122)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 127)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 130)May include surrounding context.

python

获取当前用户绑定的所有设备信息。

配置来源（统一规则）：
  - 持久化：~/.openclaw/.env （OpenClaw 客户端的"设置 API Key"会自动写入此文件）
  - 临时覆盖：仅 API_KEY 支持命令行 --api-key，覆盖 .env 中的同名配置
  - 不再读取任何 AI_GATEWAY_* 环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 42)May include surrounding context.

python

从 ~/.openclaw/.env 文件加载配置。
    这是 OpenClaw 客户端写入的持久化真值源，由所有 skill 共享。
    """
    env_path = Path.home() / ".openclaw" / ".env"
    if not env_path.exists():
        return {}
    result = {}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · list_devices.py (reported line 119)May include surrounding context.

python

从 ~/.openclaw/.env 文件加载配置。
    这是 OpenClaw 客户端写入的持久化真值源，由所有 skill 共享。
    """
    env_path = Path.home() / ".openclaw" / ".env"
    if not env_path.exists():
        return {}
    result = {}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities to read a shared credential file and make network requests, but it does not explicitly scope or constrain those tool permissions in metadata. In an agent ecosystem, missing tool-scope declarations reduce transparency and enforcement, making it easier for a seemingly simple skill to access sensitive local data and exfiltrate it over the network if the implementation drifts or is replaced.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

Relying on a shared persistent ~/.openclaw/.env file for credentials and configuration increases the lifetime and reusability of sensitive session material across runs and across skills. Persistent shared storage broadens the attack window: a malicious or compromised skill can harvest current credentials long after they were initially set.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

### Configuration Source

The script reads `~/.openclaw/.env` as the single persistent configuration source. This file is shared by all skills and uses the format `KEY=VALUE` (one entry per line). OpenClaw clients write to this file when the user updates settings. The script does NOT read any `AI_GATEWAY_*` environment variables — env variables are intentionally ignored to avoid stale Gateway-process snapshots overriding the user's latest config.

## Security Notes

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

## Security Notes

- The shared credential file `~/.openclaw/.env` is readable by all skills under the same user. Ensure file permissions are restricted (e.g. `chmod 600 ~/.openclaw/.env`) and that only the OpenClaw service user has access. The IM clients write to this file under that user's home directory.
- TLS certificate verification is enabled by default and MUST NOT be disabled in production environments (disabling it introduces man-in-the-middle attack risks, allowing attackers to intercept the API_KEY and device data)
- Before use, you MUST confirm that AI_GATEWAY_HOST points to a trusted domain
- You MUST use a least-privilege API_KEY and avoid reusing high-privilege credentials. This skill only requires device list query permission

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains natural-language documentation and CLI messages entirely in Chinese, including the script description and setup guidance. The policy for this audit flags language or locale constraints when a skill forces a specific language without user opt-in, and this file provides no alternative language option or justification for a Chinese-only experience.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The script allows TLS certificate verification to be disabled via AI_GATEWAY_VERIFY_SSL=false in a shared local config file. If this is turned off, the bearer API key and returned device identifiers can be exposed to man-in-the-middle interception or traffic tampering, especially because the host is also configurable from the same file.

Content

Scanner excerpt · list_devices.py (reported line 85)May include surrounding context.

python

def get_verify_ssl(env_vars):
    """
    判断是否启用 TLS 证书验证。默认启用。
    仅当 ~/.openclaw/.env 中显式设置 AI_GATEWAY_VERIFY_SSL=false 时禁用（仅开发环境）。
    """
    val = env_vars.get("AI_GATEWAY_VERIFY_SSL", "true").lower()
    return val not in ("false", "0", "no")

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L054 states the script does not read any AI_GATEWAY_* environment variables and treats ~/.openclaw/.env as the single persistent configuration source, but the surrounding documentation also declares an alternate command-line source for the API key at L043. This is an intent/documentation inconsistency about configuration sources and override behavior.

Content

No source excerpt is available for this finding.