T09 · Insecure Skill Coding Practices
Warning
- Location
model_failover_doctor.py:287- Finding
Unvalidated provider reassignment can corrupt or redirect model routing
- Content
View full analysis
- Remediation
View remediation
Security audit
Model Failover Doctor
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed OpenClaw repair tool, but its automatic fix can persistently rewrite model routing to hard-coded providers and restart the gateway without enough validation.
Review this skill before installing. Use --dry-run first, inspect every proposed routing change, and avoid --fix --restart unless you are comfortable with persistent changes to OpenClaw model routing and a gateway restart. Be especially cautious if you do not use or trust the hard-coded providers/models named in the script.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README forces a specific language/locale experience throughout the skill documentation, with no indication that users may choose another language. Under the policy, language constraints should be optional or clearly justified; this file provides neither an opt-in nor a region-specific justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to run a one-command repair that writes to local configuration files and restarts the gateway, but it does not present a clear, explicit warning at the point of use about service disruption and config modification. In an agent-skill context, this can lead users to trigger disruptive changes without informed consent, especially because the feature is framed as a routine fix and "一键修复 + 重启 gateway" lowers caution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content of the skill forces a specific language/locale for all users, which can violate organizational language policy when no opt-in or alternative is provided. There is no indication that the skill is region-specific or that users may choose another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This Python file contains its primary description, usage guidance, and later user-facing output entirely in Chinese, indicating a fixed language choice. The policy only allows such locale constraints when the skill offers opt-in or clearly documents a justified region-specific requirement, which is not present here.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if any_fixed and not dry_run: if restart: print('🔄 重启 gateway...') r = subprocess.run(['openclaw', 'gateway', 'restart'], capture_output=True, text=True) print((r.stdout or r.stderr).strip()) else: