Openclaw Whisperer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:29 PM UTC
• Version: 1.2.0

Overview

The skill is a legitimate OpenClaw troubleshooting helper, but it includes under-scoped setup, credential, network-facing, package-install, and privilege-changing guidance that users should review carefully before installing.

Install only if you are comfortable reviewing and manually controlling setup and repair actions. Avoid running the remote curl-to-shell commands, do not make the Docker socket world-writable, change the generated gateway bind address/token before use, and store provider API keys with restrictive permissions or a secret manager.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/installation-errors.md:32
• Finding: Remote Installation Scripts Are Executed Directly Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/installation-errors.md:32`, `references/installation-errors.md:39`, `references/installation-errors.md:105`, `references/installation-errors.md:367` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash ``` ```bash curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt-get install -y nodejs ``` ```bash curl -fsSL https://get.pnpm.io/install.sh | sh - ``` ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` ### Technical Analysis These troubleshooting instructions send content retrieved from an external server directly to a command shell. The downloaded content is not saved for inspection, and no cryptographic signature or checksum is verified before execution. The NodeSource variant is particularly dangerous because the remote response is executed through `sudo`, giving the downloaded script root privileges. The Homebrew command retrieves from the mutable `HEAD` branch rather than a version-pinned revision. Although the NVM URL contains a version, version pinning alone does not verify the integrity or authenticity of the returned bytes. This behavior exceeds the minimum privileges needed to provide diagnostic guidance. Installation documentation can instead direct users to verified packages or a download-review-verify workflow. ### Attack Path 1. An attacker compromises an upstream repository, release process, hosting account, CDN, DNS route, or other part of the delivery chain. 2. The attacker changes the response returned by one of the installation URLs. 3. A user follows the Skill's troubleshooting instructions. 4. `curl` retrieves the attacker-controlled response. 5. The shell executes the response immediately, without review or integrity validation. 6. In the ...[truncated 644 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that pipe network responses directly into `bash` or `sh`. 2. Download scripts or packages to a local file first: ```bash curl -fL -o installer.sh https://example.invalid/versioned-installer.sh ``` 3. Pin downloads to an immutable release or commit rather than `HEAD`. 4. Verify a maintainer-published cryptographic signature or SHA-256 checksum before execution: ```bash sha256sum -c installer.sh.sha256 ``` 5. Instruct the user to inspect the downloaded script before running it. 6. Prefer trusted operating-system package repositories where possible. 7. Avoid executing remote installation scripts with `sudo`; separate unprivileged retrieval and verification from narrowly scoped privileged installation steps. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/setup_helpers.py:28
• Finding: Setup Wizard Stores Provider API Keys in Plaintext and Generates a Weak Network Gateway Token<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-wizard.py:107-110`, `scripts/lib/setup_helpers.py:28-48`, `scripts/lib/utils.py:68-73` **Vulnerability Type**: Plaintext credential storage and weak authentication-token generation **Risk Level**: High ### Vulnerable Code `scripts/setup-wizard.py:107-110`: ```python console.print(f"[cyan]Selected: {provider}[/cyan]") api_key = Prompt.ask(f"Enter {provider} API key", password=True) model = Prompt.ask("Model name", default=get_model_suggestion(provider)) return {"provider": provider, "api_key": api_key, "model": model} ``` `scripts/lib/setup_helpers.py:28-48`: ```python config = { "gateway": { "port": 18789, "bind": "0.0.0.0", "authMode": "token", "authToken": f"changeme-{hash(ai_config['api_key']) % 100000000:08d}" }, "agent": { "model": ai_config["model"], "provider": ai_config["provider"], "workspace": str(Path.home() / "openclaw-workspace"), "sandboxMode": "relaxed" }, "channels": {}, "skills": {}, "plugins": [] } config["agent"][f"{ai_config['provider']}_api_key"] = ai_config["api_key"] ``` `scripts/lib/utils.py:68-73`: ```python try: path.parent.mkdir(parents=True, exist_ok=True) with open(path, 'w', encoding='utf-8') as f: json.dump(data, f, indent=2) return True ``` ### Technical Analysis The wizard masks the API key while it is entered, but then inserts the original secret directly into the generated `~/.openclaw/openclaw.json` configuration. The generic JSON writer does not explicitly set the file mode to `0600`; confidentiality therefore depends on pre-existing permissions and the user's ambient umask. The gateway authentication token is generated from Python's non-cryptographic `hash()` function and reduced modulo 100,000,000. It consequently has no more than approximately 27 bits of output space and carries a predictable `changeme-` prefix. It is also derived fr ...[truncated 1745 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store provider API keys directly in the general OpenClaw configuration. 2. Prefer an operating-system credential store, dedicated secret manager, or a separate credential file created with mode `0600`. 3. Create configuration files atomically with restrictive permissions and verify the resulting mode: ```python fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) ``` 4. Generate the gateway token independently with a cryptographically secure random generator: ```python import secrets token = secrets.token_urlsafe(32) ``` 5. Never derive the gateway token from a provider API key. 6. Bind the gateway to `127.0.0.1` by default. 7. Require explicit informed consent before binding to external interfaces. 8. Add authentication throttling, logging, and temporary lockouts where supported. 9. Ensure backup configuration files receive the same restrictive permissions as the primary configuration. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/sandbox-errors.md:38
• Finding: Troubleshooting Guidance Grants Root-Equivalent Access Through the Docker Socket<![CDATA[ ## Vulnerability Details **File Location**: `references/sandbox-errors.md:38-49` **Vulnerability Type**: Excessive local privileges and insecure Docker socket permissions **Risk Level**: High ### Vulnerable Code ```bash # Start Docker daemon (Linux) sudo systemctl start docker sudo systemctl enable docker # Start Docker Desktop (macOS/Windows) # Launch Docker Desktop application # Add user to docker group (Linux) sudo usermod -aG docker $USER newgrp docker # Fix socket permissions sudo chmod 666 /var/run/docker.sock ``` ### Technical Analysis Access to the Docker daemon is generally equivalent to root access on the host. A user controlling Docker can start privileged containers, mount the host root filesystem, access host devices, or alter host files. Adding a user to the `docker` group creates a durable privilege expansion. More critically, setting `/var/run/docker.sock` to mode `0666` grants every local account and process read/write access to the Docker daemon. This is not an appropriate fix for a socket permission error and violates least-privilege principles. The same section also enables Docker at boot. Enabling a legitimate Docker service can be operationally reasonable, but it changes persistent system state and should not be bundled casually with an access-control workaround. ### Attack Path 1. A user encounters a Docker socket permission error. 2. The user follows the recommendation and runs: ```bash sudo chmod 666 /var/run/docker.sock ``` 3. An unprivileged local attacker connects to the now world-writable Docker socket. 4. The attacker asks Docker to launch a privileged container and mount the host filesystem: ```bash docker run --rm -v /:/host alpine ... ``` 5. The container modifies files under the host mount, extracts secrets, or installs persistence. 6. The attacker obtains effective root-level control of the host. A similar result is possible if a compromised process runs under an account added to the `doc ...[truncated 596 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `sudo chmod 666 /var/run/docker.sock` recommendation entirely. 2. Prefer rootless Docker where compatible with OpenClaw. 3. If Docker-group membership is required, explicitly warn users that membership is root-equivalent. 4. Limit Docker-group membership to accounts that genuinely require daemon control. 5. Restore the socket's ownership and permissions to distribution defaults rather than making it world-writable. 6. Diagnose the root cause through the Docker systemd unit and socket configuration. 7. Present `systemctl enable docker` as an optional persistence-affecting action, separate from merely starting Docker for the current session. 8. Require explicit confirmation before recommending persistent service enablement. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/channel-errors.md:310
• Finding: Third-Party Executable Archive Is Installed Without Signature or Checksum Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/channel-errors.md:310-312`, `references/auto-fix-capabilities.md:141-147` **Vulnerability Type**: Unverified remote executable retrieval and system-wide installation **Risk Level**: High ### Vulnerable Code `references/channel-errors.md:310-312`: ```bash wget https://github.com/AsamK/signal-cli/releases/download/v0.11.11/signal-cli-0.11.11-Linux.tar.gz sudo ln -sf /opt/signal-cli-0.11.11/bin/signal-cli /usr/local/bin/ ``` `references/auto-fix-capabilities.md:141-147`: ```bash wget https://github.com/AsamK/signal-cli/releases/download/v0.11.11/signal-cli-0.11.11-Linux.tar.gz ``` ```bash sudo ln -sf /opt/signal-cli-*/bin/signal-cli /usr/local/bin/ ``` ### Technical Analysis The instructions retrieve a prebuilt third-party executable archive and make its contents available through a system executable path. No cryptographic checksum or release signature is validated before installation. The URL is version-pinned, which reduces exposure to ordinary future updates, but it does not prove that the downloaded bytes are authentic. Compromise of the upstream release account, repository, hosting infrastructure, or release artifact could cause an attacker-controlled executable to be installed. The wildcard symlink form is additionally ambiguous because it can select an unintended local directory matching `/opt/signal-cli-*`. ### Attack Path 1. An attacker compromises the upstream release process or causes a malicious archive to be served from the expected URL. 2. The user follows the channel installation instructions. 3. `wget` downloads the malicious archive without integrity verification. 4. The archive is extracted under `/opt` as directed by the surrounding installation workflow. 5. A privileged symlink exposes its executable through `/usr/local/bin/signal-cli`. 6. The malicious executable runs whenever OpenClaw or the user invokes `signal-cli`. A local attacker who can create an appropriately ...[truncated 653 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish and require verification of a pinned SHA-256 or stronger checksum. 2. Prefer a cryptographically signed release and verify its signature against a trusted maintainer key. 3. Use a trusted operating-system repository when an appropriate package is available. 4. Download to a temporary staging directory with restrictive permissions. 5. Inspect the archive contents before extraction and prevent path traversal during extraction. 6. Replace wildcard symlinks with an exact, validated version path. 7. Do not create the system-wide symlink until all verification steps succeed. 8. Document how users can independently obtain checksums or signing keys from a separate trusted channel. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Dependencies and Automatic Global Package Installation Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-19`, `requirements.txt:1-4`, `data/fix-recipes.json:267-304` **Vulnerability Type**: Non-reproducible dependency resolution and global package modification **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-19`: ```yaml install: - id: pip-deps kind: shell command: "pip install click rich requests beautifulsoup4" ``` `requirements.txt:1-4`: ```text click>=8.1.0 rich>=13.0.0 requests>=2.31.0 beautifulsoup4>=4.12.0 ``` Relevant automatic global-install recipes include: ```json { "id": "fix-pnpm-install", "title": "Install pnpm Package Manager", "safe_auto": true, "description": "Install pnpm globally", "steps": [ { "type": "command", "command": "npm install -g pnpm", "description": "Install pnpm via npm" }, { "type": "command", "command": "pnpm --version", "description": "Verify pnpm installation" } ] } ``` ```json { "id": "fix-openclaw-install", "title": "Install OpenClaw CLI", "safe_auto": true, "description": "Install openclaw command globally", "steps": [ { "type": "command", "command": "npm install -g openclaw", "description": "Install openclaw globally via npm" }, { "type": "command", "command": "openclaw --version", "description": "Verify openclaw installation" } ] } ``` ### Technical Analysis The Python installation command does not specify versions, while `requirements.txt` only defines lower bounds. The effective packages installed today can therefore differ from those reviewed with the Skill. No hash-locked dependency file is supplied. The repair database also marks global npm package installation and update operations as `safe_auto: true`. Package managers may execute lifecycle scripts during installation. A compromised publisher account, malicious future release, registry compromise, or dependency-chain compromise could consequently ex ...[truncated 1372 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct and transitive Python dependency to an exact reviewed version. 2. Generate a lock file containing cryptographic hashes, such as with `pip-compile --generate-hashes`. 3. Install into an isolated virtual environment rather than the global Python environment. 4. Keep `SKILL.md` installation metadata synchronized with the lock file. 5. Pin npm tools to exact reviewed versions instead of resolving the current latest release. 6. Require explicit user confirmation before any global package installation or update. 7. Change global installation and update recipes from `safe_auto: true` to `safe_auto: false`. 8. Review package provenance, maintainer changes, lifecycle scripts, and vulnerability advisories before upgrades. 9. Consider disabling npm lifecycle scripts where compatible and separately running only reviewed setup actions. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (234)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.

Self-Modification

High

• Category: Rogue Agent

Content

python3 {baseDir}/scripts/enhanced-doctor.py --json
```

### Self-Updater
Keep references and caches current.
```bash
# Check what's outdated

• Confidence: 95% confidence
• Finding: A self-updater in a skill is inherently high risk because it can modify local code, reference data, or execution behavior after initial review. In this context, the skill already combines diagnostics, setup, and recommendations, so self-modification further erodes reviewability and can expand capabilities over time without equivalent scrutiny.

Self-Modification

High

• Category: Rogue Agent

Content

Keep references and caches current.
```bash
# Check what's outdated
python3 {baseDir}/scripts/self-updater.py --check

# Update everything
python3 {baseDir}/scripts/self-updater.py --update

• Confidence: 96% confidence
• Finding: The explicit '--update' action indicates the skill can change local state rather than only inspect it. Self-modifying or self-refreshing behavior is dangerous because it can introduce new code/data, invalidate previous review assumptions, and potentially consume untrusted remote content.

Self-Modification

High

• Category: Rogue Agent

Content

python3 {baseDir}/scripts/self-updater.py --check

# Update everything
python3 {baseDir}/scripts/self-updater.py --update

# Update only skill cache
python3 {baseDir}/scripts/self-updater.py --update --skills-only

• Confidence: 95% confidence
• Finding: Repeated self-update capability, including targeted updates, confirms the skill supports mutation of its own local assets or caches. Even if limited to data, self-modification can still alter recommendations, diagnostics, or future command behavior in ways not visible at review time.

Self-Modification

High

• Category: Rogue Agent

Content

python3 {baseDir}/scripts/self-updater.py --update

# Update only skill cache
python3 {baseDir}/scripts/self-updater.py --update --skills-only
```

### Setup Wizard

• Confidence: 90% confidence
• Finding: A skills-only update may be narrower than full self-update, but it still modifies local trusted state and may influence future recommendations or actions. In a recommendation and maintenance tool, changing cached skill data can affect what users are encouraged to install or run.

Memory Manipulation

High

• Category: Memory Poisoning

Content

"title": "Context Window Exceeded",
      "description": "Request exceeds model's context window limit",
      "causes": ["Too many tokens in prompt", "Large conversation history", "Big file attachment", "Context accumulation"],
      "fix_steps": ["Reduce prompt length", "Clear conversation history", "Use model with larger context window", "Implement context pruning"],
      "fix_recipe_id": "fix-config-validate",
      "related_codes": ["PAYLOAD_TOO_LARGE"],
      "doc_url": "https://docs.openclaw.ai/models/context-limits"

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Gateway rejects AI provider requests

**Common Causes:**
- Missing API key in .env file
- Incorrect API key value
- API key not activated with provider
- Typo in environment variable name

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.