ClawHub
Back to skill

Security audit

mimo-api-fix

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused Mimo API diagnostic helper; it uses local config credentials and test API calls in ways that fit its stated purpose, but users should review the endpoint and config edit before running it.

Install only if you intend to troubleshoot this Mimo/OpenClaw provider. Before running the commands, confirm that ~/.openclaw/openclaw.json points to the provider endpoint you trust, use only non-sensitive test prompts, and back up openclaw.json before applying the toolCall=true fix.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

External Script Fetching

High
Category
Supply Chain
Content
BASE_URL=$(python3 -c "import json; d=json.load(open('$HOME/.openclaw/openclaw.json')); print(d['models']['providers']['custom']['baseUrl'])")

# 测试基础连通性
curl -s "$BASE_URL/models" -H "Authorization: Bearer $API_KEY" | python3 -m json.tool | head -20
```

### Step 2: 测试无工具调用
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
### Step 2: 测试无工具调用

```bash
curl -s "$BASE_URL/chat/completions" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
### Step 2: 测试无工具调用

```bash
curl -s "$BASE_URL/chat/completions" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
### 原因 3: API 端点不支持 function calling

**症状**：curl 测试带 tools 也返回 400

**修复**：确认使用的是正确的 mimo-v2.5-pro 端点，不是其他不支持 tools 的模型。
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
### 原因 3: API 端点不支持 function calling

**症状**:curl 测试带 tools 也返回 400

**修复**:确认使用的是正确的 mimo-v2.5-pro 端点,不是其他不支持 tools 的模型。
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly instructs shell usage, reads local configuration files, performs network requests, and modifies user configuration, but it declares no explicit tool scope or permissions. That mismatch increases the chance an agent executes sensitive operations without clear user awareness or policy gating.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
These instructions extract an API key from a local config and immediately use it in outbound curl requests, but provide no warning about credential sensitivity, endpoint trust, or data transmission. In an agent setting, this can lead to secrets being exposed to unintended services or users executing network diagnostics without understanding the risk.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 2: 测试无工具调用

```bash
curl -s "$BASE_URL/chat/completions" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
This command sends prompts and model parameters to an external API using a locally sourced bearer token. Even though the goal is diagnosis, it still transmits potentially sensitive metadata and normalizes outbound requests without an explicit trust boundary warning.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 3: 测试带工具调用

```bash
curl -s "$BASE_URL/chat/completions" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
91% confidence
Finding
The tool-calling test transmits prompts, tool schema, and authentication credentials to an external service. In the context of agent skills, this can leak operational details about local tool structure and encourage automatic outbound traffic without clear consent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill provides a Python one-liner that overwrites the user's configuration file in place, changing model settings without backup, validation, or rollback guidance. A mistake in the script or concurrent edits could corrupt configuration or silently alter security-relevant behavior such as enabling tool calling.

External Transmission

Medium
Category
Data Exfiltration
Content
# Test 2: 无工具调用
echo "--- Test 2: 无工具调用 ---"
RESULT=$(curl -s --connect-timeout 10 "$BASE_URL/chat/completions" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"mimo-v2.5-pro","messages":[{"role":"user","content":"hello, reply with one word"}],"max_tokens":50}' 2>/dev/null || true)
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# Test 2: 无工具调用
echo "--- Test 2: 无工具调用 ---"
RESULT=$(curl -s --connect-timeout 10 "$BASE_URL/chat/completions" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"mimo-v2.5-pro","messages":[{"role":"user","content":"hello, reply with one word"}],"max_tokens":50}' 2>/dev/null || true)
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
The skill content is written entirely in Chinese, including the description and operating instructions, with no indication that the user can choose another language. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
This markdown file is written entirely in Chinese and does not indicate that the language is optional, user-selectable, or required for a specific regional/compliance reason. Under the stated policy, a skill document that implicitly forces a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The script's comments and all user-facing status messages are written in Chinese, including usage, diagnostics, and error output. This imposes a specific language on users without any opt-in, fallback, or indication that the skill is intentionally region-specific.

Static analysis

No suspicious patterns detected.