Model Failover Doctor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:53 AM UTC
• Version: 1.0.0

Overview

This is a disclosed OpenClaw repair tool, but its automatic fix can persistently rewrite model routing to hard-coded providers and restart the gateway without enough validation.

Review this skill before installing. Use --dry-run first, inspect every proposed routing change, and avoid --fix --restart unless you are comfortable with persistent changes to OpenClaw model routing and a gateway restart. Be especially cautious if you do not use or trust the hard-coded providers/models named in the script.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: model_failover_doctor.py:287
• Finding: Unvalidated provider reassignment can corrupt or redirect model routing<![CDATA[ ## Vulnerability Details **File Location**: `model_failover_doctor.py:287-288`, `model_failover_doctor.py:341-347`, and `model_failover_doctor.py:379-380` **Vulnerability Type**: Unsafe configuration repair using unvalidated, hard-coded provider and model mappings **Risk Level**: Medium ### Vulnerable Code At `model_failover_doctor.py:287-288`, an unknown provider reference is reassigned to a hard-coded provider without verifying that the resulting provider/model pair exists: ```python # 3) 最后兜底：挂到 lovbrowser if new_val is None: new_val = f'{lb}/{model_path}' ``` At `model_failover_doctor.py:341-347`, a static fallback chain is installed when the generated chain is too short: ```python # 兜底：Intelligence 池的常见配置 if len(chain) <= 1: chain = [ 'custom-llmapi-lovbrowser-com/anthropic/claude-sonnet-4.6', 'custom-llmapi-lovbrowser-com/anthropic/claude-opus-4.6', 'custom-llmapi-lovbrowser-com/openai/gpt-5.3-codex', 'kimi-coding/k2p5', 'zai/glm-5', ] ``` At `model_failover_doctor.py:379-380`, invalid session entries are similarly reassigned to the hard-coded provider: ```python if new_entry is None: new_entry = f'{lb}/{model_path}' ``` ### Technical Analysis The repair routines detect provider prefixes that are absent from `openclaw.json`, but their final fallback behavior does not resolve the entry against an authoritative list of configured provider/model pairs. Instead, an unknown model path is attached to the hard-coded `custom-llmapi-lovbrowser-com` provider. The fallback-chain repair has the same validation weakness: when no adequate chain can be constructed, it inserts five static provider/model references without confirming that those providers are configured, that the listed models are supported, or that the operator trusts those routing destinations. Consequently, the automatic repair can replace an invalid configuration with another invalid configuration. More importantly, if the har ...[truncated 2341 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Build an authoritative set of valid provider/model pairs from `openclaw.json`, rather than validating only the provider prefix. 2. Permit an automatic replacement only when the complete target pair is explicitly present in that authoritative set. 3. Remove the fallback behavior that blindly prepends `custom-llmapi-lovbrowser-com` to an unresolved model path. 4. Remove the static fallback-chain list, or filter every entry against the active configuration before use. 5. If no verified mapping exists, leave the original entry unchanged, report that automatic repair is unsafe, and require an explicit operator selection. 6. Before writing any file, validate the complete proposed configuration and present the exact before-and-after mapping. 7. After writing, reload the files and perform a second validation pass. Do not restart the gateway if any provider/model pair remains unresolved. 8. Preserve the existing backup mechanism, but use collision-resistant backup names, such as timestamps with microseconds or random suffixes, to avoid overwriting backups created within the same second. 9. Add tests covering unknown providers, unknown models, absent hard-coded providers, unsupported model/provider combinations, and configurations with only one valid fallback. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README forces a specific language/locale experience throughout the skill documentation, with no indication that users may choose another language. Under the policy, language constraints should be optional or clearly justified; this file provides neither an opt-in nor a region-specific justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to run a one-command repair that writes to local configuration files and restarts the gateway, but it does not present a clear, explicit warning at the point of use about service disruption and config modification. In an agent-skill context, this can lead users to trigger disruptive changes without informed consent, especially because the feature is framed as a routine fix and "一键修复 + 重启 gateway" lowers caution.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language content of the skill forces a specific language/locale for all users, which can violate organizational language policy when no opt-in or alternative is provided. There is no indication that the skill is region-specific or that users may choose another language.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This Python file contains its primary description, usage guidance, and later user-facing output entirely in Chinese, indicating a fixed language choice. The policy only allows such locale constraints when the skill offers opt-in or clearly documents a justified region-specific requirement, which is not present here.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if any_fixed and not dry_run:
        if restart:
            print('🔄 重启 gateway...')
            r = subprocess.run(['openclaw', 'gateway', 'restart'],
                               capture_output=True, text=True)
            print((r.stdout or r.stderr).strip())
        else:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.