Security audit

AI 模型智能管家

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it says: monitor AI model sources, cache/report findings, and let the user manually change OpenClaw model fallback settings.

Before installing, be comfortable with scheduled network polling, use of an OpenRouter API key, local model-intelligence storage under ~/.openclaw, and manual commands that can change OpenClaw's active fallback model configuration. Review backups before using approve, reject, deploy, or rollback on a production setup.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises automated web/API collection, storage into Feishu tables, AI-generated recommendations, and eventual deployment into a model fallback chain, but it does not warn about privacy, data-handling, credential scope, approval integrity, or system-impact risks. In a skill that can both ingest external content and modify runtime model configuration, missing safety guidance increases the chance of unsafe deployment, over-collection, or accidental propagation of untrusted inputs into operational systems.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes capabilities that imply file access, file modification, and network activity, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because users and enforcement layers cannot clearly determine what the skill is allowed to do, increasing the chance of over-broad access and unintended execution of sensitive local or network operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises automated daily monitoring and scheduled collection from external platforms, but it does not warn users that it will perform recurring network access and ingest third-party data. This is risky because background data collection can surprise users, leak metadata, violate policy expectations, or pull in untrusted external content without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill promotes one-click model approval, deployment, and removal actions without an explicit warning that these operations can change active system behavior. This is dangerous because deployment-chain modifications can affect production routing, availability, cost, or security posture, and users may trigger impactful changes without understanding the consequences.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The display name and description are presented in Chinese, and scheduled task names later in the file are also Chinese-language only. The manifest does not indicate that the skill is region-specific or offer a language choice, so this creates a locale-policy concern for users who did not opt into Chinese-language behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The command triggers are single common words like 'daily', 'weekly', 'history', 'approve', 'reject', and 'deploy', which are highly likely to collide with normal user language or other skills. In an agent framework, overly broad triggers can cause unintended invocation of this skill, leading to accidental execution of monitoring, approval, or deployment-related actions in contexts the user did not intend.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The top-level CLI description presents the skill as an 'AI model steward' for automated monitoring and deployment, but the implemented commands include manual governance actions such as approve/reject as well as direct inspection and rollback of local config state. Those behaviors materially broaden the apparent scope beyond passive monitoring/report generation into hands-on configuration administration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: Commands such as approve, reject, add/remove deployment actions, and rollback perform operational configuration management rather than merely stewarding or analyzing model information. Without an explicit manifest statement that the skill is authorized to administer local model fallback configuration, these capabilities exceed what a user would infer from an intelligence/steward role.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, user prompts, and CLI help text are all Chinese-language only, which effectively forces a specific language/locale for users. Under the policy, language constraints should either be optional via user choice or explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module-level documentation states that collected intelligence is stored both locally and in a Feishu Bitable. In the actual code path, daily_intelligence only persists to DAILY_CACHE_FILE, while Feishu export is optional and only occurs in the main CLI branch when specific flags are supplied.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The execution banner and interactive API-key prompt are emitted only in Chinese, with no alternative locale or opt-in. This is a natural-language policy issue because the skill imposes a single language during runtime interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The argparse description and help strings are all written in Chinese, and the file does not offer an English or user-selectable alternative. This forces a specific language in the command-line interface without opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code directly overwrites the user's OpenClaw configuration file, which is a safety-relevant file write affecting system behavior. Although the function has an internal docstring and returns a success message after the fact, there is no pre-action confirmation or visible user-facing warning at the point of modification in this code path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Removing a model from the fallback chain changes persistent configuration and can alter runtime failover behavior. The code writes the file silently and only reports success afterward, so users are not warned before the state-changing operation occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s natural-language interface is consistently hard-coded in Chinese, including the module description and generated report content, with no option for the user to select another language. This is a locale/language policy concern because the skill imposes a specific language by default rather than offering opt-in or configurability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The visible user-facing documentation is entirely in Chinese, including the title, feature descriptions, and usage guidance, with no indication that language selection is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The user-facing name, summary, and operating instructions are presented in Chinese, which effectively forces a specific language for interaction and understanding. Under the policy, language constraints should be optional or explicitly justified rather than imposed without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire sponsor document is written in Chinese, and there is no indication that users may choose another language or that the file is intentionally limited to a Chinese-speaking audience for a documented reason. Under the policy, hard-coding a single language without opt-in can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language description is entirely in Chinese, which can indicate a language/locale constraint for the skill without any opt-in or explanation that it is intended only for Chinese-speaking users. The policy allows locale constraints when they are explicitly justified, but no such justification appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The cron job names are defined only in Chinese, which may impose a specific locale on users viewing or interacting with scheduled tasks. Because the manifest does not declare a regional scope or provide an alternative locale, this can violate language-choice expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The primary user-facing description is explicitly written in Chinese and presents the tool as a Chinese-language interface. In this file there is no indication that users can select another language or that the locale restriction is required for a region-specific use case, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language strings in the module and command-line interface are presented exclusively in Chinese, with no indication that the user can select another language. The policy for this audit flags forced language choices unless there is explicit opt-in or a documented, justified locale constraint.
Content: No source excerpt is available for this finding.