ClawHub
Back to skill

Security audit

Model Config Check

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate model-checking purpose, but it can automatically store API keys, modify model configuration, restart the gateway, and send live authenticated requests to configured endpoints without a clear consent gate.

Install only if you want this skill to actively manage and test OpenClaw model provider settings. Verify every baseUrl before use, prefer limited-scope or disposable API keys, expect live calls that may consume quota, and keep a backup or rollback path for model configuration changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs use of shell execution (`bash` and `curl`) but does not declare permissions, which creates a hidden capability gap between what reviewers/users expect and what the skill can do. Undeclared execution capability is risky because it can run subprocesses automatically after config changes and make network calls without clear upfront authorization boundaries.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs automatic writing of model configuration including user API keys into local config without explicit warning or consent about credential storage. Storing secrets implicitly increases the chance of accidental retention, exposure through logs/backups, or later misuse by other tools reading the same config.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill mandates automatic execution of a shell script after configuration changes, which means code execution can be triggered implicitly as a side effect of unrelated config operations. Automatic subprocess execution is dangerous because users may not realize commands are being run, and any compromise or modification of the referenced script would inherit that trust path.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs real API calls to external providers using supplied API keys, but does not clearly warn that credentials and request metadata will be transmitted over the network. This creates a privacy and secret-handling risk, especially when calls are performed automatically and across many third-party endpoints based on inferred provider mappings.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends live authentication material and test prompts to whatever endpoints are present in the local model configuration, with no confirmation, allowlist, or explicit warning that secrets and probe traffic will be transmitted. In this skill’s context, that is security-relevant because the feature auto-runs after config changes and can therefore exfiltrate API keys or metadata to attacker-controlled baseUrl values if configuration is malicious or mistyped.

External Transmission

Medium
Category
Data Exfiltration
Content
### 3. 网络连通性检查

使用 `exec` 执行 curl 测试每个 provider 的 baseUrl 是否可达：

```bash
curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 "<baseUrl>"
Confidence
97% confidence
Finding
The skill performs external network connectivity and live API-call testing via `curl`, causing data to leave the local environment. In context this is intentional functionality, but it is still security-relevant because it transmits to potentially user-specified endpoints and may expose API keys, model identifiers, and usage metadata without sufficient guardrails.

External Transmission

Medium
Category
Data Exfiltration
Content
| `grok-*` | xAI (Grok) | `https://api.x.ai/v1` | `openai-completions` → `/v1/chat/completions` |
| `gemini-*` | Google Gemini | `https://generativelanguage.googleapis.com/v1beta` | 特殊接口，需单独处理 |
| `mistral-*`, `codestral-*` | Mistral | `https://api.mistral.ai/v1` | `openai-completions` → `/v1/chat/completions` |
| `mimo-*` | 小米 (MiMo) | `https://api.xiaomimimo.com/anthropic` | `anthropic-messages` → `/v1/messages` |

**未匹配时：** 自动搜索 "[model_name] API documentation base_url" 确认配置。
Confidence
90% confidence
Finding
The instruction to automatically search for unknown model API documentation/base URLs introduces a dynamic external lookup step that can send user-provided model names to third-party search engines or arbitrary sites. This increases privacy risk and may lead the skill to trust unverified endpoints, making later credentialed requests more dangerous if the discovered base URL is malicious or incorrect.

Static analysis

No suspicious patterns detected.