T08 · Insecure Dependencies
Warning
- Location
scripts/model_router.py:672- Finding
Unresolved and Unpinned Executable Python Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
Model Router Hook
Security checks for vulnerabilities and agentic risk
Overview
This model-routing skill is purpose-aligned, but it stores cross-session user interaction data and changes OpenClaw session state while depending on an unbundled Python module.
Review this skill before installing. It can affect the active OpenClaw model session, persist user/profile/session/cost data under the home directory, and currently relies on a missing model_router_v3 module. Only use it if you trust the publisher, can verify the missing dependency source, and are comfortable with local cross-session memory storage.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/model_router.py:225- Finding
Non-Positive Daily Budget Causes Division-by-Zero Denial of Service
- Content
View full analysis
tuple: """Determine whether thinking mode is available.""" estimated_cost = self.estimate_cost( 'thinking', estimated_tokens, estimated_tokens // 2 ) usage_ratio = self.today_actual_cost / self.daily_budget ``` The dashboard calculation contains the same unsafe operation: ```python def get_cost_report(self) -> Dict: """Generate a cost report.""" return { 'today_actual': round(self.today_actual_cost, 4), 'today_estimated': round(self.today_cost, 4), 'daily_budget': self.daily_budget, 'usage_percent': round( self.today_actual_cost / self.daily_budget * 100, 1 ), 'call_count': len(self.records), 'avg_cost_per_call': round( self.today_actual_cost / max(len(self.records), 1), 4 ) } ``` The public factory forwards the value without validation: ```python def create_router(user_id: str = "default", daily_budget: float = 5.0, enable_ab_test: bool = False) -> ModelRouterHook: """Create a router.""" return ModelRouterHook(user_id, daily_budget, enable_ab_test) ``` ### Technical Analysis `daily_budget` is accepted through the public API and stored without validating that it is a positive, finite numeric value. Both `can_use_thinking` and `get_cost_report` use it as a divisor. Supplying `daily_budget=0` therefore raises `ZeroDivisionError`. A negative value also produces invalid cost-control decisions, while non-finite values such as `NaN` can make threshold comparisons unreliable. Routing calls pass through `ResilientModelRouter`, which catches this exception ...[truncated 1461 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises code-like capabilities including environment access, file read/write, and shell-related behavior but does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, this creates an implicit authority problem: the skill may be invoked without users or host policies clearly understanding what resources it can touch, increasing the chance of unauthorized file access, command execution, or secret exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language description and usage guidance are presented in Chinese, which effectively imposes a language/locale on the user-facing skill documentation. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking audience.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation language is broad enough to match many normal conversations about coding, analysis, querying, cost control, or model selection. Over-broad triggers can cause unexpected auto-activation of a skill that changes model behavior, persists data, or invokes privileged operations when the user did not clearly request those actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation describes persistent user-profile and session-memory storage but does not clearly warn users about retention, purpose, duration, or how to opt out. This creates privacy and compliance risk because users may unknowingly have cross-session behavioral data stored and reused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly supports cross-session memory and global user profiling without describing minimization, consent, or strict boundaries on what may be retained. Persistent collection of interaction history can capture sensitive prompts, personal data, or business information and later expose or misuse it across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example workflow instructs the agent to wait for and use the user's next message for retrospective learning, effectively turning future user input into training/assessment data without a clear consent boundary. This is dangerous because subsequent messages may contain unrelated or sensitive information that the user did not intend to be recorded for model adaptation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents persistent local storage of user profiles, session memory, and cost records in filesystem paths under the user's home directory. Storing identifiable behavioral data in predictable local files without mention of encryption, access controls, or retention limits raises substantial privacy and data leakage risk, especially on shared systems or compromised hosts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file-level title, module docstring, usage example, and many runtime user-facing messages are written only in Chinese, which effectively forces a specific language experience. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which appears here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code creates persistent storage under the user's home directory and later records session and cost history there without disclosure. Persisting detailed interaction metadata can expose sensitive prompts, behavioral patterns, and cost records to other local users, backups, or later compromise if file permissions and retention are not tightly controlled.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 方案1: 尝试使用 session_status 工具 try: # 通过 subprocess 调用 openclaw CLI result = subprocess.run( ["openclaw", "session", "status", f"--model={model_name}"], capture_output=True, text=True,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is presented as a routing hook, but it performs external CLI execution to affect session state. In an agent environment, undisclosed subprocess execution expands the trust boundary and can surprise operators, especially if the CLI has broader capabilities or inherits sensitive environment/context.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 尝试通过 CLI 获取 try: result = subprocess.run( ["openclaw", "session", "status"], capture_output=True, text=True,
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
When model switching fails, the code still records the interaction as if the recommended model was used, while the actual model may differ. This creates an integrity problem in audit, learning, and cost logic that can mislead downstream decisions and conceal operational failures, reducing the reliability of safety or budget controls.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This Python file contains user-facing natural-language text in Chinese only in the module docstring. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Writing persistent session and cost data without explicit warning undermines informed consent and can expose sensitive operational metadata over time. In agent contexts, even seemingly low-sensitivity routing history can reveal user interests, workflows, and usage patterns.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The code executes an external CLI via subprocess to inspect or influence model selection, which is a shell-execution operation covered by this rule. Although there is some logging on failure, there is no prior user-facing disclosure, confirmation, or explanatory warning near the operation about invoking a local command.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code writes and reads a process-wide environment variable to steer model behavior, which can create hidden cross-component state and unintended interference in shared runtimes. In multi-skill or long-lived agent processes, this can cause one component to influence another without clear isolation or auditability.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest promises automatic model selection, intent-based routing, budget control, and adaptive preference learning. The code additionally implements an A/B testing framework and reporting/dashboard telemetry, which are product analytics capabilities not reflected in the manifest description and go beyond the core routing behavior.
- Content