Security audit

mongolian-llm

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paid Mongolian-language API skill, with the main caution that user text, files, images, or audio may be sent to a third-party service.

Install only if you are comfortable sending relevant Mongolian text, files, images, or audio to mongol.open-idea.net under your own API key and billing account. Use it on non-sensitive content unless you trust that service, and keep the API key in local OpenClaw configuration rather than pasting it into chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ### `POST /audio/async/` `POST` → **202** + `jobId`；**3～5s** `GET /audio/async/{jobId}/` 至 **200** + `data.text`（**202**=processing，**422**=failed）。可选 `DELETE /audio/async/{jobId}/`。 ---
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Hidden Instructions

High

Category: Prompt Injection
Content: # OCR 路由：[INTERFACE-ROUTING.md](./INTERFACE-ROUTING.md)。
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: # OCR 路由：[INTERFACE-ROUTING.md](./INTERFACE-ROUTING.md)。
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: # OCR 路由：[INTERFACE-ROUTING.md](./INTERFACE-ROUTING.md)。
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list is extremely broad and includes generic terms like '蒙古语', '蒙语', '蒙古文', 'ASR', and 'TTS', which can cause the skill to activate for ordinary multilingual or audio-related requests even when the user did not intend to invoke this external service. Because the skill sends user content to a third-party API and may incur billing, overbroad activation increases the risk of unintended data disclosure, unnecessary API calls, and surprise charges.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The documentation states that input containing traditional Mongolian must be routed through the external API and forbids the model from handling it directly, imposing a fixed behavior without explicit user opt-in. This is risky because it can override user expectations about privacy and processing mode, causing sensitive text to be transmitted to a third-party service solely due to script detection rather than informed consent.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file's operational instructions are written entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a justified locale-specific requirement. This can violate language/locale policy when users are not offered an explicit language choice or opt-in.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The instruction requires that when the conversation is entirely in traditional Mongolian, the output must be entirely in that script and forbids extra Chinese characters. This is a language/locale constraint expressed as a hard rule, but the file does not indicate user choice or opt-in for that behavior.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This file is a markdown file, so natural-language policy checks apply. The system prompt explicitly mandates '请使用简体中文回答' and constrains output format, which is a language/locale restriction; the policy allows this only when the skill offers user choice or clearly documents justified constraints. Although the section title mentions Chinese output when the user explicitly requests it, the embedded prompt itself hard-codes Simplified Chinese and does not offer locale choice.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file’s natural-language instructions and API usage notes are entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy because it effectively forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The example system prompt says '请只用纯传统蒙古文回答，不要包含任何中文汉字', which mandates a single output language/script and explicitly forbids Chinese characters. This is a natural-language locale policy constraint presented without any user choice or opt-in, and no justification is given here that the endpoint is restricted to that locale.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The document specifies a default OCR parameter of `language=mw` and only switches to `mn` for Cyrillic, which imposes a language/locale choice by default. Under the policy, forcing a specific language without offering user choice or documenting justified constraints is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s operational instructions are entirely written in Chinese and do not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The rule summary is written as normative guidance and explicitly states that Mongolian-to-Chinese output is Chinese and that certain chat rules about avoiding Chinese characters do not apply. This enforces a specific language behavior without indicating user choice, opt-in, or a documented regional/compliance justification.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file’s operational instructions are written entirely in Chinese and direct fixed behavior for the TTS workflow, but do not indicate that the skill is region-specific or that the user may choose another language/locale. This creates a natural-language policy concern because the skill appears to impose a specific language context without explicit user opt-in.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The document instructs users to run `openclaw config set` and `openclaw gateway restart`, which modify local configuration and restart a local service, but it does not clearly foreground the operational effect before asking the user to do so. While the commands are plausibly legitimate setup steps, omission of an explicit warning can cause users to make environment changes without fully understanding scope, especially in a security-sensitive agent context.

Static analysis

No suspicious patterns detected.