Openclaw Router

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:51 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its model-routing purpose, but its documentation includes unsafe install and credential-handling guidance that users should review before installing.

Install only if you are comfortable with a router that can detect local API-key environment variables, write config under `~/.openclaw`, and route prompts or user-selected images to configured cloud providers. Do not run the documented `curl ... | sh` Ollama command or store API keys in `.bashrc` without reviewing safer alternatives such as signed packages, checksums, a virtual environment, and a secret manager.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/FAQ.md:289
• Finding: Unverified Remote Installation Script Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `docs/FAQ.md:281-293`; mirrored in `docs/FAQ_en.md:284-296` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code `docs/FAQ.md:281-293`: ```bash ### Q17: 检测不到 Ollama **解决：** ```bash # 检查 Ollama 服务 ollama list # 如未安装 curl -fsSL https://ollama.com/install.sh | sh # 重启服务 systemctl restart ollama ``` ``` The equivalent English instruction appears in `docs/FAQ_en.md:284-296`: ```bash ### Q17: Can't detect Ollama **Solution:** ```bash # Check Ollama service ollama list # If not installed curl -fsSL https://ollama.com/install.sh | sh # Restart service systemctl restart ollama ``` ``` ### Technical Analysis The documentation retrieves a mutable shell script from an external server and streams it directly into `sh`. The downloaded content is neither pinned to a specific release nor verified using a cryptographic checksum or signature. The user is also given no opportunity to inspect the script before it executes. Although `ollama.com` appears to be the official Ollama domain and Ollama is relevant to the declared local-model functionality, transport security alone does not establish the integrity of a mutable installation script over time. Compromise of the remote distribution infrastructure, domain, DNS resolution, TLS trust chain, or installation script could change the effective payload after this Skill has been reviewed. The adjacent `systemctl restart ollama` command is a documented service-management operation, not evidence that this project itself creates persistence. Nevertheless, users may execute these commands with elevated privileges if required by their environment, increasing the possible impact of a compromised installer. ### Attack Path 1. A user follows the Ollama troubleshooting instructions. 2. An attacker compromises the remote installation endpoint or another component in its delivery chain. 3. The attacker replaces or mo ...[truncated 1323 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl ... | sh` pipeline from both language versions of the FAQ. 2. Direct users to a versioned official package or release artifact. 3. Require users to download the artifact separately before execution. 4. Pin the documented download to a specific trusted release rather than a mutable installer URL. 5. Verify a publisher-provided digital signature or SHA-256 checksum before installation. 6. Encourage users to inspect installation scripts before executing them. 7. Avoid recommending root execution unless it is explicitly necessary, and document which operations require elevation. 8. Keep the Chinese and English documentation synchronized so the unsafe command is not reintroduced in one version. A safer general workflow is: ```bash curl -fLO https://trusted.example/releases/<pinned-version>/installer.sh printf '%s installer.sh\n' '<publisher-provided-sha256>' | sha256sum --check - less installer.sh sh installer.sh ``` The actual URL, version, checksum, and verification mechanism must come from an authenticated official release channel. ]]>

T08 · Insecure Dependencies

Warning

• Location: docs/FAQ.md:276
• Finding: Unpinned Python Dependencies Installed from a Mutable Package Index<![CDATA[ ## Vulnerability Details **File Location**: `docs/FAQ.md:268-277`; mirrored in `docs/FAQ_en.md:270-280` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `docs/FAQ.md:268-277`: ```bash # 检查 Python python3 --version # 需要 3.8+ # 检查依赖 pip3 list | grep -E "requests|psutil|pyyaml" # 重新安装依赖 pip3 install requests psutil pyyaml ``` The equivalent English instruction appears in `docs/FAQ_en.md:270-280`: ```bash # Check Python python3 --version # Need 3.8+ # Check dependencies pip3 list | grep -E "requests|psutil|pyyaml" # Reinstall dependencies pip3 install requests psutil pyyaml ``` ### Technical Analysis The command installs packages by name without exact version pins or cryptographic hashes. Package resolution therefore depends on the user's current pip configuration, configured indexes, dependency resolver, and the latest compatible packages available when the command is run. The named packages are legitimate and are also declared with minimum versions in `clawhub.json`. No evidence of typosquatting or a known malicious package was identified. The risk arises because the installation source and resulting dependency set remain mutable after review. If a configured package index, package release, maintainer account, or transitive dependency is compromised, pip may install attacker-controlled code. Installation hooks and subsequently imported modules can execute code in the user's environment. ### Attack Path 1. A user follows the troubleshooting instructions and runs the unpinned `pip3 install` command. 2. Pip consults the user's configured package index or mirror. 3. An attacker compromises an index, mirror, maintainer account, package release, or transitive dependency. 4. Pip resolves and downloads the compromised package because no exact version or artifact hash is required. 5. Malicious code executes during package installation or when the Skill imports the affected dependency. ...[truncated 664 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a reviewed lock file containing exact dependency and transitive-dependency versions. 2. Generate and require cryptographic hashes for all permitted package artifacts. 3. Install dependencies using hash enforcement, for example: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Document a trusted package index explicitly and use TLS-protected index URLs. 5. Recommend installation inside a dedicated virtual environment rather than the system Python environment. 6. Avoid advising users to run pip with `sudo` or administrative privileges. 7. Use automated dependency scanning and update the lock file through a controlled review process. 8. Apply the same corrected instructions to both `docs/FAQ.md` and `docs/FAQ_en.md`. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (94)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.

External Script Fetching

High

• Category: Supply Chain

Content

ollama list

# 如未安装
curl -fsSL https://ollama.com/install.sh | sh

# 重启服务
systemctl restart ollama

• Confidence: 98% confidence
• Finding: The documentation instructs users to fetch and immediately execute a remote shell script with curl ... | sh. This is dangerous because it gives arbitrary code from a remote server immediate execution on the user's machine without signature verification, checksum validation, or an opportunity to inspect the script.

Chaining Abuse

High

• Category: Tool Misuse

Content

ollama list

# 如未安装
curl -fsSL https://ollama.com/install.sh | sh

# 重启服务
systemctl restart ollama

• Confidence: 98% confidence
• Finding: The | sh pipeline is a classic command-chaining risk because it streams untrusted network content directly into a shell interpreter. If the remote host, DNS, CDN, TLS trust chain, or served script is compromised, users could run attacker-controlled commands immediately.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

**
```bash
# 检查 Ollama 服务
ollama list

# 如未安装
curl -fsSL https://ollama.com/install.sh | sh

# 重启服务
systemctl restart ollama
```

---

### Q18: 云 API 检测失败

**解决：**
```bash
# 检查环境变量
echo $DASHSCOPE_API_KEY
echo $OPENAI_API_KEY

# 如未设置
export DASHSCOPE_API_KEY="sk-..."
export OPENAI_API_KEY="sk-..."

# 永久设置（添加到 ~/.bashrc）
echo 'export DASHSCOPE_API_KEY="sk-..."' >> ~/.bashrc
source ~/.bashrc
```

---

### Q19: 配置保存失败

**解决：**
```bash
# 检查目录权限
ls -la ~/.openclaw/

# 如需要，创建目录
mkdir -p ~/.openclaw
chmod 755 ~/.openclaw
```

---

### Q20: 模型选择不符合预期

**解决：**
```bash
# 检查阈值配置
cat ~/.openclaw/router_config.yaml | grep -A5 thresholds

# 调整阈值
nano ~/.openclaw/router_config.yaml

# 使用标签强制
[L3] 这个问题很重要，用专家模型
```

---

## 📞 其他问题

### Q21: 如何反馈问题？

**A:** 
- GitHub Issue: h

• Confidence: 93% confidence
• Finding: Appending export DASHSCOPE_API_KEY="sk-..." to ~/.bashrc creates long-lived plaintext credentials in a startup file, which can be exposed through backups, dotfile syncing, accidental sharing, or local compromise. Although not malware in this context, the persistence behavior meaningfully increases the blast radius of API key leakage.

External Script Fetching

High

• Category: Supply Chain

Content

ollama list

# If not installed
curl -fsSL https://ollama.com/install.sh | sh

# Restart service
systemctl restart ollama

• Confidence: 99% confidence
• Finding: The FAQ tells users to fetch and immediately execute a remote script with curl ... | sh, which bypasses integrity verification, code review, and standard package trust controls. If the remote host, connection, or delivered script is compromised, users may execute arbitrary attacker-controlled code on their systems.

Chaining Abuse

High

• Category: Tool Misuse

Content

ollama list

# If not installed
curl -fsSL https://ollama.com/install.sh | sh

# Restart service
systemctl restart ollama

• Confidence: 99% confidence
• Finding: The shell pipe into sh is a command-chaining pattern that turns network content directly into code execution. In documentation aimed at broad users, this materially raises the likelihood of supply-chain compromise and accidental execution of malicious payloads without review.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

# Check Ollama service
ollama list

# If not installed
curl -fsSL https://ollama.com/install.sh | sh

# Restart service
systemctl restart ollama
```

---

### Q18: Cloud API detection failed

**Solution:**
```bash
# Check environment variables
echo $DASHSCOPE_API_KEY
echo $OPENAI_API_KEY

# If not set
export DASHSCOPE_API_KEY="sk-..."
export OPENAI_API_KEY="sk-..."

# Permanent (add to ~/.bashrc)
echo 'export DASHSCOPE_API_KEY="sk-..."' >> ~/.bashrc
source ~/.bashrc
```

---

### Q19: Configuration save failed

**Solution:**
```bash
# Check directory permissions
ls -la ~/.openclaw/

# If needed, create directory
mkdir -p ~/.openclaw
chmod 755 ~/.openclaw
```

---

### Q20: Model selection doesn't match expectations

**Solution:**
```bash
# Check threshold config
cat ~/.openclaw/router_config.yaml | grep -A5 thresholds

# Adjust thresholds
nano ~/.openclaw/router_config.yaml

# Use tags to force
[L3] This is important, use expert model
```

---

## 📞 Other Questions

### Q21: How to

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The cloud provider screenshot section encourages displaying multiple provider credentials and configuration details across several services without any sanitization warning. In the context of an AI routing skill that aggregates many cloud LLM providers, a leaked screenshot could expose reusable API keys or sensitive tenant information spanning multiple accounts, greatly increasing blast radius and cost-abuse risk.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file contains user-facing natural-language content solely in Chinese, including headings, instructions, and status summaries. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the restriction is explicitly justified, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file is predominantly written in Chinese, including operational instructions and submission steps, while presenting itself as a final checklist for submission. Under the policy rule, language constraints should offer user choice or clearly justify the locale; this file does not indicate that Chinese is optional or region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown file presents the checklist primarily in Chinese while also labeling `README.md` as the English main document and `README_zh.md` as the Chinese main document. That creates a language-policy inconsistency because the current skill artifact itself defaults to a specific language without offering a language choice or documenting that the file is intended only for a Chinese audience.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file contains user-facing instructions and descriptions exclusively in Chinese, including headings, FAQ content, support information, and licensing explanations. Under the policy rule for natural-language violations, forcing a specific language without opt-in can exclude users and constitutes a locale/language policy issue when no alternative or justification is provided.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This markdown file states that the skill auto-detects providers based on environment variables including API keys and cloud credentials. Because markdown files should warn about behaviors affecting privacy or sensitive system data, the absence of an explicit warning that the skill reads credential-related environment variables is a meaningful disclosure gap.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The fallback behavior is described as unconditionally falling back to English, which can impose a language preference on users who did not choose it. The policy allows locale constraints only when users are offered a choice or the constraint is justified; this section does not document either beyond a manual override feature.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file is written as a user-facing report entirely in Chinese from the title onward, with no indication that language selection is optional or that the skill is intended only for a Chinese-language audience. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire markdown file is written in Chinese, including headings, instructions, pricing details, and calls to action, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which this document does not provide.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The product intro promotes automatic model routing and environment detection, and elsewhere explicitly lists cloud providers/models, but it does not clearly warn that user prompts and possibly environment-derived metadata may be transmitted to third-party cloud services. This creates a real transparency and privacy risk because users may enable the skill assuming processing is local or cost-free when some requests can be sent externally and incur charges.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The quick-start flow tells users to install, configure, and enable the router automatically, but does not warn that activation can change prompt handling, trigger external cloud processing, and generate billable requests. This is dangerous because users may activate the skill without informed consent about data exposure, provider routing, or financial impact.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises automatic detection of cloud providers via environment variables containing API credentials, but it does not warn users that enabling these providers may send prompts or data to third-party services. In a model-routing skill, that omission is security-relevant because users may assume routing stays local while sensitive content is silently eligible for external transmission whenever credentials are present.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that the router automatically detects multiple cloud-provider credentials from environment variables, but it does not clearly warn users that prompts, context, or other data may be routed to third-party services when those credentials are present. In a model-routing skill, this omission is security-relevant because users may expect local-only behavior while sensitive data is silently eligible for cloud transmission.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: The skill metadata does not declare any explicit tool permissions or allowed-tools, yet the analyzed behavior indicates access to environment variables, filesystem reads/writes, and network use. That mismatch reduces transparency and prevents users from making an informed trust decision, especially because the skill claims benign routing functionality while requiring broader capabilities.

Static analysis

No suspicious patterns detected.