ClawHub
Back to skill

Security audit

OpenClaw Model Provider

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear model-provider setup purpose, but it gives users unsafe patterns for handling API keys that deserve review before installation.

Install only if you are comfortable configuring OpenClaw provider credentials manually. Do not paste real API keys into chat, avoid storing keys directly in OpenClaw JSON or shell files when a safer secret mechanism is available, do not use echo commands that print full keys, and rotate any key that may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:105
Finding

Plaintext API Credential Collection, Storage, and Disclosure

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:33
  • SKILL.md:105-122
  • SKILL.md:227-229
  • SKILL.md:237-251
  • SKILL.md:290
  • references/openclaw-config-reference.md:49-53

Vulnerability Type: Plaintext sensitive-data handling
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:105-122 presents shell startup files and the OpenClaw configuration as locations for plaintext credentials:

bash
export PROVIDER_API_KEY="sk-xxxxx"
json
{
  "env": {
    "PROVIDER_API_KEY": "sk-xxxxx"
  }
}

SKILL.md:227-229 recommends displaying the complete credential in terminal output:

bash
echo $PROVIDER_API_KEY

SKILL.md:237-251 provides additional plaintext multi-key examples:

json
{
  "env": {
    "PROVIDER_API_KEY_1": "sk-xxx1",
    "PROVIDER_API_KEY_2": "sk-xxx2",
    "PROVIDER_API_KEY_3": "sk-xxx3"
  }
}
bash
export PROVIDER_API_KEYS="sk-xxx1,sk-xxx2,sk-xxx3"

references/openclaw-config-reference.md:49-53 embeds an API credential directly in configuration:

json
"env": {
  "ENV_VAR": "actual-api-key"
}

The workflow also directs the agent to collect an API key from the user at SKILL.md:33 and describes the user as providing the key at SKILL.md:290.

Technical Analysis

API keys are bearer credentials. Any party that obtains a key can generally exercise the permissions assigned to it without additional authentication.

The skill correctly uses environment-variable references in some provider examples, but it also instructs users to place actual credentials in shell initialization files or the OpenClaw JSON configuration. These are persistent plaintext locations and can be exposed through configuration backups, source-control mistakes, diagnostic bundles, broad file permissions, or other local processes and users.

Requesting that the user provide a raw API key to the agent can additionally ...[truncated 1839 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not ask users to paste raw API keys into chat. Instruct them to provision credentials locally outside the agent conversation.
  2. Generate configuration containing only indirect references such as:
    json
    {
  "apiKey": "${PROVIDER_API_KEY}"
}
  3. Remove examples that place real credentials in the OpenClaw env object or shell startup files. Prefer an operating-system secret store, a dedicated secrets manager, or OpenClaw's documented secure credential mechanism.
  4. Replace echo $PROVIDER_API_KEY with a non-disclosing presence check, such as:
    bash
    if [ -n "${PROVIDER_API_KEY:-}" ]; then
  printf '%s\n' "PROVIDER_API_KEY is set"
else
  printf '%s\n' "PROVIDER_API_KEY is not set"
fi
  5. If a local credential file is unavoidable, require restrictive permissions such as chmod 600, exclude it from source control and routine support bundles, and clearly document the residual plaintext-storage risk.
  6. Ensure generated backups do not contain credentials. If secret-bearing backups already exist, delete them securely where feasible and rotate the affected keys.
  7. Redact credentials from logs, command output, validation errors, screenshots, and diagnostic reports.
  8. Recommend narrowly scoped provider keys, spending limits, expiration where supported, regular rotation, and immediate revocation after suspected exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill recommends using a .env file for API keys without any guidance on file permissions, exclusion from version control, or local disclosure risks. Because this skill is centered on handling provider credentials, encouraging .env storage without safeguards can lead to accidental credential exposure through repos, backups, shared directories, or support bundles.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

}

text

**方式 3：.env 文件（如果 OpenClaw 支持）**

## 常见提供商模板

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill title, instructions, examples, and operational guidance are all presented in Chinese, which effectively forces a specific language for users of the skill. Under the stated policy, a language constraint should either be optional for the user or clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly asks the user to provide an API key and later shows storing secrets directly in configuration, but it does not warn that the assistant should avoid collecting, echoing, logging, or persisting credentials in chat or config files. In a skill whose purpose is provider onboarding, this increases the chance that users disclose secrets into the agent interaction or save them insecurely, leading to credential exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
询问用户提供：
1. **提供商名称**（如 `my-openai-proxy`）
2. **API 基础地址**（如 `https://api.xxx.com/v1`）
3. **API 密钥**
4. **模型 ID**（如 `gpt-4`, `kimi-k2.5`）
5. **接口类型**：

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
询问用户提供：
1. **提供商名称**（如 `my-openai-proxy`）
2. **API 基础地址**（如 `https://api.xxx.com/v1`）
3. **API 密钥**
4. **模型 ID**（如 `gpt-4`, `kimi-k2.5`）
5. **接口类型**：

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
"models": {
    "providers": {
      "custom-openai": {
        "baseUrl": "https://api.openai-proxy.com/v1",
        "apiKey": "${OPENAI_PROXY_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
"models": {
    "providers": {
      "moonshot": {
        "baseUrl": "https://api.moonshot.ai/v1",
        "apiKey": "${MOONSHOT_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md
1. 确认是自定义提供商（非内置）
2. 收集信息：
   - 名称：`siliconflow`
   - 地址：`https://api.siliconflow.cn/v1`
   - API Key：用户提供的 key
   - 模型：`deepseek-ai/DeepSeek-R1`
3. 生成配置并指导用户应用

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/openclaw-config-reference.md (reported line 28)May include surrounding context.

md
"mode": "merge",
    "providers": {
      "provider-name": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "${ENV_VAR}",
        "api": "openai-completions",
        "models": [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example shows a literal API key stored in the configuration env section ("ENV_VAR": "actual-api-key") without a strong warning that secrets should not be committed to files, shared, or stored in plaintext. In a model-provider configuration skill, this is especially risky because users are likely to copy-paste the example directly into real configs, leading to credential exposure through source control, backups, logs, or local file disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

整份技能文档仅以中文呈现，没有提供语言选择、双语版本或说明其仅适用于特定中文用户群。根据语言/区域政策，若无用户选择或明确、合理的范围限定，强制单一语言属于自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.