ClawHub
Back to skill

Security audit

Kimi2.5skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only troubleshooting skill for OpenClaw image-model failures, with no hidden code or automatic behavior found.

Treat this as an operations runbook. Before following it, identify the affected agent, back up models.json, avoid exposing provider secrets, validate the JSON after edits, and restart the gateway only when you are comfortable with possible impact to active workloads.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill directs operators to edit agent-level `models.json` files and restart the gateway, but it does not warn about change scope, validation, rollback, or the possibility of impacting other agents and shared runtime behavior. In an operational troubleshooting skill, those omissions can lead to accidental misconfiguration, service disruption, or broader model registry failures, especially since the document itself states that a bad provider entry can poison image runtime registration.

Static analysis

No suspicious patterns detected.