Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed paid Mongolian-language API skill, with the main caution that user text, files, images, or audio may be sent to a third-party service.
Install only if you are comfortable sending relevant Mongolian text, files, images, or audio to mongol.open-idea.net under your own API key and billing account. Use it on non-sensitive content unless you trust that service, and keep the API key in local OpenClaw configuration rather than pasting it into chat.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
### `POST /audio/async/`
`POST` → **202** + `jobId`；**3～5s** `GET /audio/async/{jobId}/` 至 **200** + `data.text`（**202**=processing，**422**=failed）。可选 `DELETE /audio/async/{jobId}/`。
---
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# OCR
路由：[INTERFACE-ROUTING.md](./INTERFACE-ROUTING.md)。
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# OCR
路由：[INTERFACE-ROUTING.md](./INTERFACE-ROUTING.md)。
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# OCR
路由：[INTERFACE-ROUTING.md](./INTERFACE-ROUTING.md)。
The trigger list is extremely broad and includes generic terms like '蒙古语', '蒙语', '蒙古文', 'ASR', and 'TTS', which can cause the skill to activate for ordinary multilingual or audio-related requests even when the user did not intend to invoke this external service. Because the skill sends user content to a third-party API and may incur billing, overbroad activation increases the risk of unintended data disclosure, unnecessary API calls, and surprise charges.
The documentation states that input containing traditional Mongolian must be routed through the external API and forbids the model from handling it directly, imposing a fixed behavior without explicit user opt-in. This is risky because it can override user expectations about privacy and processing mode, causing sensitive text to be transmitted to a third-party service solely due to script detection rather than informed consent.
The file's operational instructions are written entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a justified locale-specific requirement. This can violate language/locale policy when users are not offered an explicit language choice or opt-in.
The instruction requires that when the conversation is entirely in traditional Mongolian, the output must be entirely in that script and forbids extra Chinese characters. This is a language/locale constraint expressed as a hard rule, but the file does not indicate user choice or opt-in for that behavior.
This file is a markdown file, so natural-language policy checks apply. The system prompt explicitly mandates '请使用简体中文回答' and constrains output format, which is a language/locale restriction; the policy allows this only when the skill offers user choice or clearly documents justified constraints. Although the section title mentions Chinese output when the user explicitly requests it, the embedded prompt itself hard-codes Simplified Chinese and does not offer locale choice.
The file’s natural-language instructions and API usage notes are entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy because it effectively forces a specific language without user opt-in.
The example system prompt says '请只用纯传统蒙古文回答，不要包含任何中文汉字', which mandates a single output language/script and explicitly forbids Chinese characters. This is a natural-language locale policy constraint presented without any user choice or opt-in, and no justification is given here that the endpoint is restricted to that locale.
The document specifies a default OCR parameter of language=mw and only switches to mn for Cyrillic, which imposes a language/locale choice by default. Under the policy, forcing a specific language without offering user choice or documenting justified constraints is a natural-language policy violation.
The file’s operational instructions are entirely written in Chinese and do not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The rule summary is written as normative guidance and explicitly states that Mongolian-to-Chinese output is Chinese and that certain chat rules about avoiding Chinese characters do not apply. This enforces a specific language behavior without indicating user choice, opt-in, or a documented regional/compliance justification.
The file’s operational instructions are written entirely in Chinese and direct fixed behavior for the TTS workflow, but do not indicate that the skill is region-specific or that the user may choose another language/locale. This creates a natural-language policy concern because the skill appears to impose a specific language context without explicit user opt-in.
The document instructs users to run openclaw config set and openclaw gateway restart, which modify local configuration and restart a local service, but it does not clearly foreground the operational effect before asking the user to do so. While the commands are plausibly legitimate setup steps, omission of an explicit warning can cause users to make environment changes without fully understanding scope, especially in a security-sensitive agent context.