ClawHub
Back to skill

Security audit

free-model-router-laodao

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed local model router, but it needs Review because its local admin surface can expose keys and high-impact controls too broadly.

Install only if you are comfortable running a persistent local router that stores provider API keys and talks to the freemodel control servers. Treat the admin UI as sensitive, avoid running the displayed curl-to-shell update command, remove scheduled tasks manually on uninstall, and do not keep it running while browsing untrusted sites until the local admin/CORS behavior is fixed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
core/admin/public/js/admin.js:1
Finding

Unverified Remote Script Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
core/server-client.js:1
Finding

Control-Server Announcements Can Inject Instructions into Scheduled Agent Output

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
core/admin/auth.js:1
Finding

Loopback Authentication Bypass Combined with Wildcard CORS Exposes Administrative APIs

Content
View full analysis
0&&n.includes(r)){ const r=e.headers["x-forwarded-for"]; if(r){ const e=r.split(",")[0].trim(); if(LOCAL_IPS.includes(e))return!0 } } return!1 } function checkAuth(e,r){ if(isLocalAccess(e))return{authorized:!0}; if(!requiresAuth(e,r))return{authorized:!0}; const t=extractToken(e); if(!t)return r.startsWith("/admin") ?{authorized:!1,redirect:"/admin/login.html"} :{authorized:!1,error:"未登录，请先登录"}; const n=verifyToken(t); return n.valid ?{authorized:!0,username:n.username} :r.startsWith("/admin") ?{authorized:!1,redirect:"/admin/login.html",error:n.error} :{authorized:!1,error:n.error} } ``` The server permits cross-origin access: ```javascript r.setHeader("Access-Control-Allow-Origin","*"), r.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"), r.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization") ``` Administrative API authorization relies on the preceding local-access rule: ```javascript if(o.startsWith("/api/")){ const{handleAuthApi:n}=adminRoutes.registerRoutes({}); if(o.startsWith("/api/auth/")&&n(e,r,o))return; const i=auth.checkAuth(e,o); return i.authorized ?void await _handleApi(e,r,s,o,t) :void _sendJson(r,401,{ok:!1,error:i.error||"Unauthorized"}) } ``` ### Technical Analysis The server treats the network source address as an authentication credential. Requests made by JavaScript running on a hostile w ...[truncated 1609 chars]
Remediation
View remediation

other

Warning
Location
core/fingerprint.js:1
Finding

Automatic Persistent Device Fingerprinting and External Registration

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
scripts/cron-setup.js:1
Finding

Uninstall Does Not Remove Recurring Scheduled Tasks

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package-lock.json:34
Finding

Dependency Lockfile Resolves Packages Through a Third-Party Registry Mirror

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (128)

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code can apply updates via /api/apply-update and terminate the process via /api/shutdown. These are dangerous control-plane actions not inherent to routing; if exposed through weak admin auth, session theft, or CSRF, they allow denial of service and potentially unreviewed code changes on the host.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Auto-update logic that downloads remote installers or scripts and executes them (.exe, install.sh) is highly sensitive and materially different from a routing helper. Remote code execution via update channels is one of the highest-risk supply-chain patterns, especially when hidden behind an under-declared skill capability set.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

generateSRPToken() signs SRP tokens with a key derived from the supplied SRP secret (pbkdf2Sync(r, "sign", ...)), but verifyToken() verifies tokens marked with admin_token_srp_v1 using config.admin.tokenSecret instead. This means SRP-token validation does not match generation semantics, so the advertised SRP-based auth path is broken and any code relying on SRP tokens may fail open/closed unpredictably, creating authentication design drift and increasing the chance of insecure fallback to weaker login paths.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · core/admin/public/index.html (reported line 45)May include surrounding context.

html
<span class="nav-text">反馈</span>
        </a>
      </nav>
      <!-- Sidebar 社区入口 -->
      <div class="sidebar-community" id="sidebarCommunity">
        <div class="sidebar-community-header">
          <span class="sidebar-community-icon">&#x1f465;</span>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · core/admin/public/index.html (reported line 72)May include surrounding context.

html
<div id="quickStartBody"></div>
        </section>

        <!-- 概览页面 -->
        <div id="dashboard-page" class="page active">
          <!-- 公告 Banner -->
          <div id="announcementBanner" class="announcement-banner-container" style="display:none">

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The UI presents a manual update command curl -sSL https://freemodel.eu.org/install.sh | bash -s -- --force, which encourages piping a remotely fetched script directly into a shell. If the remote host, DNS, TLS termination, CDN path, or update infrastructure is compromised, an administrator could execute arbitrary code on the host; this is especially dangerous here because the skill administers routing infrastructure and likely runs with elevated system access.

Content

Scanner excerpt · core/admin/public/js/admin.js (reported line 1)May include surrounding context.

js
const API_BASE="";let _isLocalAccess=!1;function getAuthHeaders(){if(_isLocalAccess)return{};const e=localStorage.getItem("adminToken");return e?{Authorization:"Bearer "+e}:{}}async function initAuth(){try{const e=await fetch("/api/auth/status"),t=await e.json();if(t.success&&t.data.isLocalAccess)return _isLocalAccess=!0,void initApp()}catch(e){console.warn("[Admin] 无法获取认证状态，使用默认检查")}await _checkTokenAndRedirect()&&initApp()}async function _checkTokenAndRedirect(){const e=localStorage.getItem("adminToken");if(!e)return _clearAdminCookie(),window.location.href="/admin/login.html",!1;try{const t=await fetch("/api/auth/verify",{headers:{Authorization:"Bearer "+e}});if(!(await t.json()).success)return localStorage.removeItem("adminToken"),EntitlementsCache.clear(),_clearAdminCookie(),window.location.href="/admin/login.html",!1;_syncAdminCookie(e)}catch(e){return localStorage.removeItem("adminToken"),EntitlementsCache.clear(),_clearAdminCookie(),window.location.href="/admin/login.html",!1}return!0}function _syncAdminCookie(e){document.cookie="admin_token="+e+";path=/;max-age=604800;SameSite=Strict"}function _clearAdminCookie(){document.cookie="admin_token=;path=/;max-age=0"}const UPDATE_PHASE_LABELS={idle:"空闲",downloading:"正在下载...",installing:"正在安装...",completed:"更新完成",failed:"更新失败"},UpdateState={currentVersion:null,latestVersion:null,releaseNotes:"",hasUpdate:!1,platform:null,skillRestartCommand:null,statusTimer:null},UpdateUI={init(){const e=document.getElementById("updateBtn");e&&e.addEventListener("click",()=>this.showDetail());const t=document.getElementById("updateDetailModal");t&&t.querySelectorAll(".modal-close, .modal-cancel").forEach(e=>{e.addEventListener("click",()=>this.hideDetail())});const n=document.getElementById("confirmUpdateBtn");n&&n.addEventListener("click",()=>this.applyUpdate());const a=document.getElementById("updateRefreshBtn");a&&a.addEventListener("click",()=>location.reload());const o=document.getElementById("copyManualUpdateBtn");o&&o.addEve
...[truncated 27 chars]

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is described as a free model routing service, yet this file implements admin registration, SRP-based authentication, and token issuance. That hidden privileged access functionality materially expands the attack surface and trust boundary beyond the declared purpose, making review, deployment, and operator consent harder; in a routing-focused skill context, undocumented auth/admin code is especially dangerous because it can introduce backdoor-like control paths or privileged administration features users did not intend to install.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This routing-focused client also exposes an administrative credit-granting function via grantCredits, pulling an admin token from environment/config and sending privileged requests to /api/v1/credits/grant. Embedding admin-capable logic in a broadly deployed client materially expands the attack surface: if the function is reachable, misused, or the token is present on non-admin systems, it can enable unauthorized credit issuance and privilege abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file implements telemetry upload, feedback submission, credits, referrals, redemption, and entitlement operations that are unrelated to a router's stated purpose. Mixing these business and telemetry functions into the routing service broadens the trust boundary and creates unnecessary access paths to sensitive account and monetization actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code can apply updates via /api/apply-update and terminate the process via /api/shutdown. These are dangerous control-plane actions not inherent to routing; if exposed through weak admin auth, session theft, or CSRF, they allow denial of service and potentially unreviewed code changes on the host.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
core/update-service.js:1

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/free-model-cli.js:1

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/free-model-cli.js:1