Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Blueai Models
v1.1.0Configure and manage AI models from BlueAI unified proxy service for OpenClaw. Use when: (1) adding new models to openclaw.json, (2) choosing the right model...
⭐ 0· 78·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description match the included scripts and docs: the skill adds models to openclaw.json and tests connectivity against a BlueAI relay. Modifying ~/.openclaw/openclaw.json is expected for this purpose. However, some implementation choices (see below) are surprising for a 'test all configured models' operation.
Instruction Scope
SKILL.md instructs running the included scripts to add and test models which is consistent, but the test script's --all-configured mode does not use each provider's configured baseUrl; it uses a single base URL argument (defaulting to the BlueAI relay). That means testing 'all configured' will contact the relay for every model and will present whichever API key the script finds — not necessarily the key intended for that provider. This deviates from reasonable scope and can cause unintended key disclosure.
Install Mechanism
Instruction-only with lightweight Python helper scripts; no installer, downloads, or extracted archives. No suspicious install behavior.
Credentials
Metadata declares no required env vars, but test_model.py searches OPENAI_API_KEY and BLUEAI_API_KEY and add_model/test scripts read/write ~/.openclaw/openclaw.json to find/store apiKey values. The code can take a found API key and send it to the default relay — this is proportionate if the key is a BlueAI key, but dangerous if it's an unrelated provider key (e.g., a personal OpenAI key) because the script may transmit it to the relay without making that explicit.
Persistence & Privilege
add_model.py writes to the user's ~/.openclaw/openclaw.json to add providers/models (expected behavior). always:false and no global config modifications beyond the openclaw.json file. This is normal for a configuration helper, but users should be aware it will modify their config file.
What to consider before installing
This package largely does what it promises (editing ~/.openclaw/openclaw.json and calling a BlueAI relay), but there are two important gotchas you should understand before running it:
1) test_model.py will look for API keys in environment variables (OPENAI_API_KEY, BLUEAI_API_KEY) and inside your ~/.openclaw/openclaw.json and will use the first key it finds. If you run python3 scripts/test_model.py --all-configured (the undocumented risky case), the script will call a single base URL (default: https://bmc-llm-relay.bluemediagroup.cn/v1) for every configured model rather than each provider's configured endpoint — this can cause your unrelated provider keys (for example your OpenAI key) to be sent to the BlueAI relay. Do NOT run --all-configured unless you understand which key will be used.
2) The SKILL metadata declares no required env vars but the code does read env vars and the openclaw.json for apiKey values. Inspect the scripts yourself (they are small and included) before running. Prefer running targeted commands (test a single model and pass --api-key explicitly) or use a throwaway/test API key when exercising the scripts. Back up ~/.openclaw/openclaw.json before running add_model.py.
If you want to proceed: review the two scripts, run test_model.py for single models with --api-key or ensure your config only contains keys intended for the BlueAI relay, and avoid --all-configured unless you update the script to use each provider's configured baseUrl and to avoid using unrelated keys.Like a lobster shell, security has layers — review code before you run it.
latestvk970cbs0yvsxrq8zk7rdbfwrvd8437yn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.