ClawHub
Back to skill

Security audit

Add SiliconFlow Provider (98+ Models, Free Tier)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Chinese-language setup guide for adding SiliconFlow as an OpenClaw model provider, with no hidden execution or persistence found.

Install only if you intend to route OpenClaw model requests through SiliconFlow. Treat the SiliconFlow API key as a secret, avoid committing the OpenClaw config, review the fallback changes before applying them, and use a neutral official signup path if you do not want to use the included invitation link.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

External Script Fetching

High
Category
Supply Chain
Content
### 验证 API Key

```bash
curl -s 'https://api.siliconflow.cn/v1/user/info' \
  -H 'Authorization: Bearer <YOUR_API_KEY>' | python3 -m json.tool
```
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
### 查询余额

```bash
curl -s 'https://api.siliconflow.cn/v1/user/info' \
  -H 'Authorization: Bearer <API_KEY>' | python3 -c "
import json,sys; d=json.load(sys.stdin)['data']
print(f'充值余额: ¥{d[\"chargeBalance\"]}')
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# 所有 chat 模型
curl -s 'https://api.siliconflow.cn/v1/models?sub_type=chat' \
  -H 'Authorization: Bearer <API_KEY>' | python3 -c "
import json,sys
models = json.load(sys.stdin)['data']
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are overly broad, including generic requests like adding Kimi, Qwen3, free models, or DeepSeek, which may cause the skill to activate outside the user's intent to configure a new provider. In an agent setting, this can lead to unintended configuration changes, provider insertion, or credential-handling workflows being launched when the user only asked about model usage.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to paste API keys directly into config and command examples without explicit safeguards for secret handling, increasing the chance of credential leakage through shell history, logs, screenshots, shared configs, or version control. In admin-oriented workflows, such omissions materially raise the risk of token compromise.

External Transmission

Medium
Category
Data Exfiltration
Content
### 测试模型

```bash
curl -s 'https://api.siliconflow.cn/v1/chat/completions' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The skill description and all user-facing instructions are written entirely in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific reason. Under the language/locale policy, this is a natural-language policy concern because it imposes a language choice without user opt-in.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
All user-facing instructions and activation examples are presented only in Chinese, and the skill does not indicate that the language is optional or limited to a specific Chinese-only deployment context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Context-Inappropriate Capability

Low
Confidence
94% confidence
Finding
The skill includes an affiliate/invitation registration link that is not necessary for the core task of configuring an existing SiliconFlow provider in OpenClaw. This creates an incentive misalignment and can steer users toward third-party sign-up flows, increasing phishing, trust, and supply-chain risk in administrative workflows.

Context-Inappropriate Capability

Low
Confidence
95% confidence
Finding
Repeating referral-based registration links in prerequisites extends the skill beyond its declared purpose and normalizes clicking promotional links during an admin setup task. While not directly exploitable code, it is unsafe documentation behavior because it conditions users to trust external links embedded in operational instructions.

Static analysis

No suspicious patterns detected.