智图云仓 Token 路由

• Outcome: Review
• Latest audit: May 28, 2026 · 10:12 AM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it does more than the short listing says and can write persistent OpenClaw workspace state or agent-guidance files.

Install only if you want a broad OpenClaw cost-optimization toolkit, not just a simple model router. Review generated AGENTS and HEARTBEAT files before using them, avoid running overwrite-style helper commands casually, and be aware that local usage metadata is stored under ~/.openclaw/workspace/memory.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises strong safety properties in frontmatter, but the documentation clearly describes file reads/writes, local state persistence, and use of external AI providers, creating a capability/declaration mismatch. This undermines trust and permission review, because operators may install it assuming a narrower and safer footprint than the skill actually requires.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a narrow tool-required model router, but the file documents substantially broader functions including context selection, AGENTS generation, heartbeat control, budget tracking, persistence, and provider strategy. That mismatch is security-relevant because hidden or undocumented behaviors can alter workspace files, influence routing, and send prompts to external providers without informed operator consent.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The README claims the scripts are 'local-only' with 'no system modifications,' yet elsewhere it instructs users to copy files into the workspace and apply configuration patches. Misrepresenting modification behavior can cause users to trust and install the skill without understanding that it changes local state, weakening informed consent and potentially masking future riskier behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest presents the skill as a simple model router, while the body describes a much larger operational toolkit. This is a form of security documentation integrity failure: reviewers and users cannot reliably assess risk when the manifest understates scope, especially for a skill that can influence context loading, budgeting, and workspace state.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file’s implemented behavior materially diverges from the skill manifest: it performs context tracking and generates workspace instructions rather than the advertised model-routing function. In an agent skill, this kind of capability mismatch is dangerous because users and orchestrators may trust the manifest while the code silently changes agent behavior and workspace policy, increasing the chance of unauthorized persistence or prompt-governance tampering.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The generated AGENTS.md injects hard-coded model-selection rules for Haiku/Sonnet/Opus that conflict with the manifest’s stated Bailian/OpenRouter routing design. Because AGENTS.md often influences downstream agent behavior, this can misroute requests, bypass expected cost/safety controls, and create a deceptive configuration surface where the declared routing policy is not the one actually imposed.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The generated content claims model selection is 'ENFORCED' and mandates specific models, but the script contains no enforcement logic. This is dangerous because it creates false assurances for operators and may lead them to believe security, cost, or routing controls exist when they do not, causing unsafe reliance on non-existent protections.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The heartbeat command writes a file into a fixed location under the user's home directory, which is outside the stated routing functionality and modifies persistent workspace state. Even though it copies a local template rather than arbitrary attacker input, unexpected file writes can alter agent behavior, overwrite user customizations, or create trust boundary issues in environments where skills are expected to be read-only or narrowly scoped.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script persistently records file access history to a state file in the user’s home directory without clear disclosure, consent, retention limits, or access controls. In an agent environment, this metadata can reveal sensitive working patterns, project names, or memory file usage over time, creating a privacy and surveillance risk even if file contents are not stored.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The `generate-agents` command writes a new AGENTS.md-derived file directly into the workspace without an explicit confirmation step or dry-run default. Since AGENTS.md can affect future agent behavior, silent file generation can alter operational policy or seed misleading instructions into the workspace, especially if invoked by automation.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The reset command deletes the persistent heartbeat state file immediately without confirmation, backup, or safety checks. In an agent skill context, destructive local state operations are more sensitive because automated or indirect invocation can erase scheduling history and configuration unexpectedly, causing loss of operational state and potentially disrupting dependent automations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The command unconditionally copies a template to ~/.openclaw/workspace/HEARTBEAT.md, overwriting any existing file without backup, prompt, or safety check. This can destroy user data or silently replace a control/documentation file that may influence downstream agent workflows, making the behavior risky even if the source template itself is benign.

Static analysis

No suspicious patterns detected.