Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward local CLI for OpenRouter-backed web search, with expected external API use and only user-directed file output.
Before installing, understand that searches, prompts, and optional system prompts are sent to OpenRouter for web-backed model responses. Use a scoped OpenRouter API key, avoid submitting secrets or regulated data, and choose `--output` paths carefully because the CLI writes directly to the named file.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
program.outputHelp();
return;
}
await runQuery(query, opts.model, opts.format, opts.system, opts.output, opts.format);
});
program
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
.option('-s, --system <prompt>', 'optional system prompt')
.action(async (queryParts, opts) => {
const query = Array.isArray(queryParts) ? queryParts.join(' ').trim() : '';
await runQuery(query, model, opts.format, opts.system || system, opts.output, opts.format);
});
}
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
git clone https://github.com/iamjameskeane/openclaw-sonar.git cd openclaw-sonar chmod +x scripts/openrouter-sonar.ts mkdir -p ~/.local/bin ln -sf "$PWD/scripts/openrouter-sonar.ts" ~/.local/bin/sonar
The skill documents capabilities that use environment variables and make network-backed requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens user awareness and policy enforcement, making it easier for an agent to invoke the skill without clear disclosure that it will access secrets and send data externally.
The skill instructs users to supply an OpenRouter API key and use web-search-backed queries, but it does not clearly warn that prompts, search terms, and related data are transmitted to OpenRouter and potentially onward through search providers. Users may unknowingly send sensitive business data, credentials, or regulated information to third-party services.
The CLI sends user queries and optional system prompts directly to OpenRouter, which is an external service, but the script itself does not present a clear runtime disclosure or consent prompt before transmitting that data. In a local CLI that may be used on sensitive prompts, this creates a real privacy/data-handling risk because users may unknowingly send proprietary or confidential text off-host.
The skill advertises an --output option that writes results to local files, but it does not warn users that existing files may be overwritten. In agentic or scripted use, this can lead to accidental clobbering of local data or writing sensitive model output to an unintended path.