free-model-router-laodao

• Outcome: Review
• Latest audit: Aug 12, 2026 · 4:22 AM UTC
• Version: 2.2.0

Overview

The skill is mostly a disclosed local model router, but it also ships under-scoped admin, credit-grant, and updater capabilities that go beyond ordinary routing.

Install only if you are comfortable with a persistent local router that modifies OpenClaw config, stores provider keys locally, talks to freemodel control servers, and can be administered from localhost. Keep reporting disabled unless needed, avoid exposing 127.0.0.1:5678 through proxies or tunnels, do not set ADMIN_TOKEN in ordinary end-user installs, and require confirmations for stop/uninstall/provider-disable/model-role changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that include shell execution, file read/write, network access, environment usage, config modification, and cron/task setup, yet no explicit permissions are declared. This creates a transparency and consent gap: the host or user cannot accurately reason about the skill’s effective privilege level, increasing the chance of over-trusting a highly privileged component.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a local model router, but the documented behavior extends into remote registration, device fingerprinting, telemetry, announcements, recommendation/credits flows, local state persistence, cron automation, and configuration mutation. That mismatch is dangerous because users may authorize a seemingly narrow routing tool without realizing it introduces persistent background tasks, remote communications, identity correlation, and control-plane features beyond the stated scope.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The `checkAuth` function unconditionally authorizes any request that `isLocalAccess` classifies as localhost, bypassing all token and session checks for `/admin` and `/api/*` routes. This is dangerous because localhost trust is often reachable via reverse proxies, SSRF, local malware, container/network namespace quirks, or misconfigured trusted proxy headers, turning a convenience shortcut into full administrative access.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The comment states that local access does not require admin setup, but the code only performs a client-side redirect based on `/api/auth/status`. If the backend actually trusts 'local access' or relies on this UI behavior rather than server-side enforcement, an attacker able to appear local (e.g., via reverse proxy misconfiguration, localhost exposure, or SSRF-style access paths) could bypass intended setup/authentication controls.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code generates a persistent device identifier and a stable system fingerprint derived from hostname, home directory, platform, and architecture, even though those identifiers are not clearly necessary for basic model routing. This creates a durable tracking primitive that can be used to correlate users or hosts across runs and potentially across services if transmitted elsewhere, with no user disclosure or consent visible in this file.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code automatically downloads arbitrary user-supplied image URLs in `_inlineImageUrls()` via `_downloadImageAsBase64()` using server-side HTTP/HTTPS requests. This expands the router into a generic network fetcher and can be abused for SSRF-style access to internal services, metadata endpoints, or unintended outbound requests, even though size and content-type checks exist.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: `_logReasoningContentDiagnostic()` writes request-derived diagnostic data, including message metadata and top-level request fields, to a local JSONL log file. Even if truncated and partially summarized, this creates a persistent local record of potentially sensitive prompt content, tool metadata, and usage context that exceeds minimal routing needs.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This client module does substantially more than model routing: it includes credit balance queries, entitlement redemption, referral handling, feedback submission, update checks, and server-mediated account operations. Expanding a low-level router component into account/credit functions increases attack surface and trust requirements, especially because the skill is described as a routing/configuration helper rather than an account-management client.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The exported grantCredits function reads an admin token from environment/config and sends it to a remote server to grant credits to arbitrary API keys. Embedding administrative capability in a client-side router is highly dangerous because compromise of the client, config, logs, or calling path could enable unauthorized credit issuance or abuse of privileged backend functionality.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The server implements referral, credits, redemption, and entitlement-management endpoints unrelated to model routing, such as `/api/referral/*`, `/api/credits/*`, and redemption APIs. These features broaden the trust boundary, increase the number of sensitive operations exposed over HTTP, and create additional opportunities for abuse or account-impacting bugs.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The server implements referral, credits, redemption, and entitlement-management endpoints unrelated to model routing, such as `/api/referral/*`, `/api/credits/*`, and redemption APIs. These features broaden the trust boundary, increase the number of sensitive operations exposed over HTTP, and create additional opportunities for abuse or account-impacting bugs.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The server implements referral, credits, redemption, and entitlement-management endpoints unrelated to model routing, such as `/api/referral/*`, `/api/credits/*`, and redemption APIs. These features broaden the trust boundary, increase the number of sensitive operations exposed over HTTP, and create additional opportunities for abuse or account-impacting bugs.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements a full self-update mechanism that downloads and executes installers or runs an install shell script, which materially exceeds the stated skill purpose of model routing/configuration. That creates a high-risk remote code execution and supply-chain surface because any compromise of the update source, server response, or local invocation path can lead to arbitrary code execution on the host.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code spawns a downloaded Windows installer with silent flags and executes a local install.sh via bash/sh in detached mode, giving the skill direct process-execution capability unrelated to normal routing behavior. In the context of an agent skill, this is especially dangerous because it enables unattended system modification and arbitrary command execution if the update path or bundled script is tampered with.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The intent-matching rules include broad natural-language triggers such as phrases for setup, model switching, disabling providers, stopping the router, uninstalling, and diagnosing outages. Overbroad matching can cause unintended execution of privileged operations from ordinary conversation, especially because the documented actions include config changes, service stop, and uninstall behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The UI displays shell commands for manual update, including a remote-piped installer pattern, without prominent safety warnings or integrity verification guidance. This encourages administrators to execute high-risk commands directly on their host, making compromise of the remote install script or domain an immediate path to arbitrary code execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The login flow stores the admin token in localStorage and then mirrors it into a JavaScript-set cookie. Tokens in localStorage are accessible to any injected script, and a client-set cookie cannot be marked HttpOnly, so an XSS bug anywhere on the origin could steal long-lived admin credentials and compromise the admin panel.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The page reads an existing admin token from localStorage and transmits it as a Bearer token for verification. This means any script running in the page context can access and reuse the token, turning any XSS on this origin into immediate admin account takeover; the skill context increases severity because this is an administrative interface for routing/provider configuration.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The page stores the returned admin token in `localStorage` and also sets it via `document.cookie`, meaning the token is accessible to JavaScript and cannot be protected with `HttpOnly`. Any XSS in this origin, malicious browser extension, or injected third-party script could read and exfiltrate the admin token, resulting in full administrator session compromise.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The system fingerprint is deterministically derived from host and home-directory information, which are host-specific attributes that can act as quasi-identifiers. Even though the value is hashed, hashing does not eliminate the privacy concern because the fingerprint remains stable and linkable for the same environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The system fingerprint is deterministically derived from host and home-directory information, which are host-specific attributes that can act as quasi-identifiers. Even though the value is hashed, hashing does not eliminate the privacy concern because the fingerprint remains stable and linkable for the same environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This file automatically uploads monitoring data to remote servers when `passThrough` is set and reporting is enabled, but the code itself shows no explicit consent flow, disclosure, or data-minimization guard before transmission. Because request summaries include metadata such as endpoint, provider/model identifiers, error messages, and potentially other operational details, users may have telemetry sent off-host without clear awareness, creating a privacy and trust risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code accesses an administrative credential via process.env.ADMIN_TOKEN or config and transmits it as X-Admin-Token in a network request, with no local warning, privilege gating, or separation from normal client functionality. In a client-side skill, exposing admin credential use this way materially raises the chance of secret leakage and unauthorized privileged operations if the runtime or configuration is accessible to untrusted users or plugins.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code accesses an administrative credential via process.env.ADMIN_TOKEN or config and transmits it as X-Admin-Token in a network request, with no local warning, privilege gating, or separation from normal client functionality. In a client-side skill, exposing admin credential use this way materially raises the chance of secret leakage and unauthorized privileged operations if the runtime or configuration is accessible to untrusted users or plugins.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The monitoring code transmits device fingerprint data and an API-key-derived prefix together with detailed usage/error snapshots to a remote server, without any visible disclosure in this file. This combination enables persistent identification and behavioral profiling beyond what a routing component needs, increasing privacy harm if the remote service is compromised or the collection is undisclosed.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: core/update-service.js:1

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/free-model-cli.js:1

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/free-model-cli.js:1