Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its model-routing purpose, but its documentation includes unsafe install and credential-handling guidance that users should review before installing.
Install only if you are comfortable with a router that can detect local API-key environment variables, write config under `~/.openclaw`, and route prompts or user-selected images to configured cloud providers. Do not run the documented `curl ... | sh` Ollama command or store API keys in `.bashrc` without reviewing safer alternatives such as signed packages, checksums, a virtual environment, and a secret manager.
docs/FAQ.md:289Unverified Remote Installation Script Executed Directly by the Shell
docs/FAQ.md:276Unpinned Python Dependencies Installed from a Mutable Package Index
The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.
The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.
The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.
The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.
The reported behavior includes vision analysis, OCR, screenshot inspection, local file/image access, and transmission of image data to external APIs, none of which aligns with the advertised routing purpose. This creates a severe risk of exfiltrating highly sensitive on-screen or local-file content to third-party providers under misleading pretenses.
The documentation instructs users to fetch and immediately execute a remote shell script with curl ... | sh. This is dangerous because it gives arbitrary code from a remote server immediate execution on the user's machine without signature verification, checksum validation, or an opportunity to inspect the script.
ollama list
# 如未安装
curl -fsSL https://ollama.com/install.sh | sh
# 重启服务
systemctl restart ollama
The | sh pipeline is a classic command-chaining risk because it streams untrusted network content directly into a shell interpreter. If the remote host, DNS, CDN, TLS trust chain, or served script is compromised, users could run attacker-controlled commands immediately.
ollama list
# 如未安装
curl -fsSL https://ollama.com/install.sh | sh
# 重启服务
systemctl restart ollama
Appending export DASHSCOPE_API_KEY="sk-..." to ~/.bashrc creates long-lived plaintext credentials in a startup file, which can be exposed through backups, dotfile syncing, accidental sharing, or local compromise. Although not malware in this context, the persistence behavior meaningfully increases the blast radius of API key leakage.
**
# 检查 Ollama 服务
ollama list
# 如未安装
curl -fsSL https://ollama.com/install.sh | sh
# 重启服务
systemctl restart ollama
解决：
# 检查环境变量
echo $DASHSCOPE_API_KEY
echo $OPENAI_API_KEY
# 如未设置
export DASHSCOPE_API_KEY="sk-..."
export OPENAI_API_KEY="sk-..."
# 永久设置（添加到 ~/.bashrc）
echo 'export DASHSCOPE_API_KEY="sk-..."' >> ~/.bashrc
source ~/.bashrc
解决：
# 检查目录权限
ls -la ~/.openclaw/
# 如需要，创建目录
mkdir -p ~/.openclaw
chmod 755 ~/.openclaw
解决：
# 检查阈值配置
cat ~/.openclaw/router_config.yaml | grep -A5 thresholds
# 调整阈值
nano ~/.openclaw/router_config.yaml
# 使用标签强制
[L3] 这个问题很重要，用专家模型
A:
The FAQ tells users to fetch and immediately execute a remote script with curl ... | sh, which bypasses integrity verification, code review, and standard package trust controls. If the remote host, connection, or delivered script is compromised, users may execute arbitrary attacker-controlled code on their systems.
ollama list
# If not installed
curl -fsSL https://ollama.com/install.sh | sh
# Restart service
systemctl restart ollama
The shell pipe into sh is a command-chaining pattern that turns network content directly into code execution. In documentation aimed at broad users, this materially raises the likelihood of supply-chain compromise and accidental execution of malicious payloads without review.
ollama list
# If not installed
curl -fsSL https://ollama.com/install.sh | sh
# Restart service
systemctl restart ollama
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
ollama list
curl -fsSL https://ollama.com/install.sh | sh
systemctl restart ollama
---
### Q18: Cloud API detection failed
**Solution:**
```bash
# Check environment variables
echo $DASHSCOPE_API_KEY
echo $OPENAI_API_KEY
# If not set
export DASHSCOPE_API_KEY="sk-..."
export OPENAI_API_KEY="sk-..."
# Permanent (add to ~/.bashrc)
echo 'export DASHSCOPE_API_KEY="sk-..."' >> ~/.bashrc
source ~/.bashrc
Solution:
# Check directory permissions
ls -la ~/.openclaw/
# If needed, create directory
mkdir -p ~/.openclaw
chmod 755 ~/.openclaw
Solution:
# Check threshold config
cat ~/.openclaw/router_config.yaml | grep -A5 thresholds
# Adjust thresholds
nano ~/.openclaw/router_config.yaml
# Use tags to force
[L3] This is important, use expert model
The cloud provider screenshot section encourages displaying multiple provider credentials and configuration details across several services without any sanitization warning. In the context of an AI routing skill that aggregates many cloud LLM providers, a leaked screenshot could expose reusable API keys or sensitive tenant information spanning multiple accounts, greatly increasing blast radius and cost-abuse risk.
This markdown file contains user-facing natural-language content solely in Chinese, including headings, instructions, and status summaries. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the restriction is explicitly justified, which is not stated here.
This markdown file is predominantly written in Chinese, including operational instructions and submission steps, while presenting itself as a final checklist for submission. Under the policy rule, language constraints should offer user choice or clearly justify the locale; this file does not indicate that Chinese is optional or region-specific.
This markdown file presents the checklist primarily in Chinese while also labeling README.md as the English main document and README_zh.md as the Chinese main document. That creates a language-policy inconsistency because the current skill artifact itself defaults to a specific language without offering a language choice or documenting that the file is intended only for a Chinese audience.
This markdown file contains user-facing instructions and descriptions exclusively in Chinese, including headings, FAQ content, support information, and licensing explanations. Under the policy rule for natural-language violations, forcing a specific language without opt-in can exclude users and constitutes a locale/language policy issue when no alternative or justification is provided.
This markdown file states that the skill auto-detects providers based on environment variables including API keys and cloud credentials. Because markdown files should warn about behaviors affecting privacy or sensitive system data, the absence of an explicit warning that the skill reads credential-related environment variables is a meaningful disclosure gap.
The fallback behavior is described as unconditionally falling back to English, which can impose a language preference on users who did not choose it. The policy allows locale constraints only when users are offered a choice or the constraint is justified; this section does not document either beyond a manual override feature.
This markdown file is written as a user-facing report entirely in Chinese from the title onward, with no indication that language selection is optional or that the skill is intended only for a Chinese-language audience. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or justification.
The entire markdown file is written in Chinese, including headings, instructions, pricing details, and calls to action, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which this document does not provide.
The product intro promotes automatic model routing and environment detection, and elsewhere explicitly lists cloud providers/models, but it does not clearly warn that user prompts and possibly environment-derived metadata may be transmitted to third-party cloud services. This creates a real transparency and privacy risk because users may enable the skill assuming processing is local or cost-free when some requests can be sent externally and incur charges.
The quick-start flow tells users to install, configure, and enable the router automatically, but does not warn that activation can change prompt handling, trigger external cloud processing, and generate billable requests. This is dangerous because users may activate the skill without informed consent about data exposure, provider routing, or financial impact.
The README advertises automatic detection of cloud providers via environment variables containing API credentials, but it does not warn users that enabling these providers may send prompts or data to third-party services. In a model-routing skill, that omission is security-relevant because users may assume routing stays local while sensitive content is silently eligible for external transmission whenever credentials are present.
The README states that the router automatically detects multiple cloud-provider credentials from environment variables, but it does not clearly warn users that prompts, context, or other data may be routed to third-party services when those credentials are present. In a model-routing skill, this omission is security-relevant because users may expect local-only behavior while sensitive data is silently eligible for cloud transmission.
The skill metadata does not declare any explicit tool permissions or allowed-tools, yet the analyzed behavior indicates access to environment variables, filesystem reads/writes, and network use. That mismatch reduces transparency and prevents users from making an informed trust decision, especially because the skill claims benign routing functionality while requiring broader capabilities.
No suspicious patterns detected.