Model Route Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:26 AM UTC
• Version: 1.0.0

Overview

The skill is meant to fix OpenClaw model routing, but its repair steps can overwrite global configuration, delete an agent configuration file, and restart the gateway without backup or confirmation.

Install only if you are comfortable with a skill that may change OpenClaw routing configuration. Before running the fix, review the exact files, back up openclaw.json and models.json, confirm the Bailian endpoint is correct for your account, and avoid running the provided secret scan in a directory that may contain plaintext credentials unless output is redacted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55
• Finding: Destructive Removal of the Complete Agent Model Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–58 **Vulnerability Type**: Destructive configuration handling without backup, confirmation, or scoped modification **Risk Level**: Medium ### Vulnerable Code ```powershell # Remove conflicting agent override if (Test-Path $agentCfgPath) { Remove-Item $agentCfgPath -Force } ``` ### Technical Analysis The conflict-remediation workflow forcefully deletes the complete agent-level `models.json` file to remove a single potentially conflicting Bailian provider override. The file may contain unrelated provider definitions, model selections, or other agent-specific settings. The operation is not limited to `providers.bailian.baseUrl` and is performed without: - Creating a backup - Confirming the deletion with the user - Validating the file's contents or schema - Preserving unrelated configuration properties - Providing an automatic rollback mechanism This violates safe configuration-management principles. Although the path is fixed under the user's OpenClaw directory rather than being directly attacker-controlled, invoking the documented repair can cause broader configuration loss than necessary. ### Attack Path 1. An agent has a `~/.openclaw/agents/main/agent/models.json` file containing a conflicting Bailian endpoint and unrelated valid model or provider settings. 2. The user follows the skill's conflict-remediation workflow. 3. `Test-Path` confirms that the agent configuration exists. 4. `Remove-Item -Force` deletes the entire file without confirmation or backup. 5. The workflow restarts the OpenClaw gateway. 6. The agent loses all configuration stored exclusively in that file, not merely the conflicting endpoint override. ### Impact Assessment The command executes with the current user's filesystem privileges and can delete that user's complete main-agent model configuration. It does not demonstrate privilege escalation or access beyond the current account. Potential effects ...[truncated 389 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a timestamped backup before making any change: ```powershell $backupPath = "$agentCfgPath.$(Get-Date -Format 'yyyyMMddHHmmss').bak" Copy-Item $agentCfgPath $backupPath ``` 2. Parse the JSON and update or remove only the conflicting `providers.bailian.baseUrl` property. Preserve all unrelated providers, models, and agent settings. 3. If deletion of the complete file is genuinely required, display the affected path and request explicit user confirmation. 4. Serialize the modified configuration to a temporary file, parse it again to verify valid JSON, and then atomically replace the original file. 5. Validate routing before restarting the gateway. 6. If post-change verification fails, restore the backup automatically and report the rollback. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/privacy-checklist.md:10
• Finding: Secret-Scanning Command Discloses Complete Credential-Bearing Lines<![CDATA[ ## Vulnerability Details **File Location**: `references/privacy-checklist.md`, lines 10–12 **Vulnerability Type**: Plaintext sensitive-data disclosure through diagnostic output **Risk Level**: Medium ### Vulnerable Code ```powershell Get-ChildItem . -Recurse -File | Select-String -Pattern 'apiKey|token|secret|password' -CaseSensitive:$false ``` ### Technical Analysis PowerShell's `Select-String` returns match information that includes the complete matching line by default. If a scanned file contains an inline credential, such as an API key, token, secret, or password, the command can print the credential value verbatim. This behavior contradicts the checklist's requirement to redact tokens and the skill's stated policy that API keys must not appear in audit output. Terminal output may also be retained in shell transcripts, CI logs, agent conversation context, remote-support sessions, or monitoring systems. The command also scans every recursively discovered file without first excluding binary files, logs, backups, or other sensitive artifacts. Merely searching for secrets can therefore create an additional disclosure channel. ### Attack Path 1. A file in the scanned directory contains a line such as `apiKey = "sensitive-value"`. 2. The user or agent runs the documented recursive scan command. 3. `Select-String` matches the term `apiKey`. 4. PowerShell emits the full matching line, including the credential value. 5. The plaintext credential becomes visible in the terminal or captured execution output. 6. Anyone with access to the terminal session, agent context, transcript, or downstream logs may obtain and misuse the credential. ### Impact Assessment This issue does not grant additional local privileges by itself. Its impact depends on the permissions associated with any exposed credential. Potential consequences include: - Unauthorized use of model-provider or service APIs - Consumption of paid quotas and resulting financial loss - Acces ...[truncated 337 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not print matching line contents. Report only file paths and line numbers. 2. Apply redaction before any output if contextual text is required. 3. Avoid preserving even the first four characters of highly sensitive credentials unless operationally necessary. 4. Exclude binary files, generated output, logs, backups, and version-control metadata where appropriate. 5. Ensure scan output is not written to shared or persistent logs. A safer path-and-line-number-only approach is: ```powershell Get-ChildItem . -Recurse -File | Select-String -Pattern 'apiKey|token|secret|password' -CaseSensitive:$false | ForEach-Object { [PSCustomObject]@{ Path = $_.Path LineNumber = $_.LineNumber } } ``` If a preview is necessary, replace suspected values with a fixed marker such as `[REDACTED]` before displaying or storing the result. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to overwrite a global configuration file and forcibly delete an agent-specific override file using `Remove-Item -Force`, then restart the gateway, without any explicit confirmation, backup, or rollback guidance. These are destructive state-changing actions that can break a working setup, remove intentionally customized routing, or cause service disruption if the inferred 'correct' endpoint is wrong for the environment.

Static analysis

No suspicious patterns detected.