cascadeflow: Cost + Latency Reduction

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:21 PM UTC
• Version: 1.1.1

Overview

CascadeFlow is a coherent OpenClaw provider skill, but it asks users or agents to install and run a credential-bearing local service using unsafe setup patterns that deserve review before installation.

Review the setup commands before allowing an agent to run them. Prefer an exact reviewed CascadeFlow version with trusted hashes or a lock file, do not source untrusted .env files, keep the server on localhost unless you configure TLS and strong tokens, and use limited-scope API keys with spending limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51
• Finding: Third-Party Package Installation Without Trusted Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:51-55`, `SKILL.md:60-62`, `references/clawhub_publish_pack.md:63-76` **Vulnerability Type**: Insecure dependency installation and ineffective artifact verification **Risk Level**: Medium ### Vulnerable Code `SKILL.md:51-55`: ```bash python3 -m venv .venv source .venv/bin/activate python -m pip install --upgrade "cascadeflow[openclaw]>=0.7,<0.8" python -m pip show cascadeflow python -m pip download --no-deps "cascadeflow[openclaw]>=0.7,<0.8" -d /tmp/cascadeflow_pkg python -m pip hash /tmp/cascadeflow_pkg/cascadeflow-*.whl ``` `references/clawhub_publish_pack.md:63-76`: ```bash python3 -m venv .venv source .venv/bin/activate python -m pip install --upgrade "cascadeflow[openclaw]>=0.7,<0.8" python -m pip show cascadeflow python -m pip download --no-deps "cascadeflow[openclaw]>=0.7,<0.8" -d /tmp/cascadeflow_pkg python -m pip hash /tmp/cascadeflow_pkg/cascadeflow-*.whl ``` ```bash # Anthropic-only preset users python -m pip install --upgrade "cascadeflow[openclaw,anthropic]>=0.7,<0.8" # OpenAI-only preset users python -m pip install --upgrade "cascadeflow[openclaw,openai]>=0.7,<0.8" # Mixed preset users (OpenAI + Anthropic + common providers) python -m pip install --upgrade "cascadeflow[openclaw,providers]>=0.7,<0.8" ``` ### Technical Analysis The installation instructions accept any `cascadeflow` release in the `0.7.x` range rather than an exact, previously audited version. They also permit resolution and installation of transitive dependencies without a lock file or trusted hash set. Running `pip hash` after downloading an artifact only calculates the digest of the artifact that was retrieved. The instructions do not compare that digest against an independently distributed trusted value, so this step cannot detect a compromised package repository, malicious release, or substituted artifact. In a ...[truncated 1543 chars]
• Remediation: ## Remediation Suggestions - Pin CascadeFlow to an exact, reviewed version instead of a version range. - Lock every transitive dependency using a reproducible lock file. - Publish trusted SHA-256 values through a channel independent of the package artifact. - Download artifacts before installation, verify them against the trusted digest, and abort on mismatch. - Install using `pip --require-hashes` and a fully hashed requirements file. - Avoid `--upgrade` in automated Agent instructions unless an explicit update review is performed. - Use a dedicated virtual environment and a least-privileged service account. - Provide provenance or signature-verification instructions where supported. - Ensure provider keys available to the service have minimal permissions, quotas, and rotation procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73
• Finding: Arbitrary Shell Execution Through Sourcing of Environment Files## Vulnerability Details **File Location**: `SKILL.md:73`, `references/clawhub_publish_pack.md:107`, `references/clawhub_publish_pack.md:121` **Vulnerability Type**: Unsafe interpretation of configuration data as shell code **Risk Level**: Medium ### Vulnerable Code `SKILL.md:73`: ```bash set -a; source .env; set +a ``` `references/clawhub_publish_pack.md:107`: ```bash set -a; source .env; set +a ``` `references/clawhub_publish_pack.md:121`: ```bash set -a; source .env; set +a ``` ### Technical Analysis The shell built-in `source` evaluates the contents of `.env` as shell syntax. A dotenv file is therefore not treated solely as a collection of key-value records: command substitutions, function definitions, redirections, pipelines, and arbitrary commands are executed by the current shell. For example, a malicious entry such as `TOKEN=$(malicious-command)` would execute the command while the file is sourced. Since the same shell immediately launches the provider, injected code can also alter exported variables, executable search paths, or other process settings. This issue requires the `.env` file or its creation workflow to be influenced by an attacker. It does not independently grant access to an attacker who cannot control that file. ### Attack Path 1. An attacker supplies, modifies, or causes the user to copy an untrusted `.env` file into the working directory. 2. The user or setup Agent follows the documented server-start procedure. 3. The current shell executes `source .env`. 4. Shell expressions and commands embedded in `.env` execute with the launching user's privileges. 5. The injected commands can read local files, capture provider keys, alter the environment, or replace the command that is subsequently resolved and launched. 6. Stolen data can be transmitted using any network access already available to the user process. ### Impact Assessment Exploitation provides arbitrary command ...[truncated 442 chars]
• Remediation: ## Remediation Suggestions - Do not load dotenv configuration with `source`, `.`, or another shell evaluator. - Parse `.env` using a dotenv library that treats entries as data and rejects shell expressions. - Allowlist expected names such as `OPENAI_API_KEY` and `ANTHROPIC_API_KEY`. - Reject malformed entries, command substitutions, unexpected variable names, and embedded control characters. - Prefer a service manager or secrets facility that injects credentials without evaluating a project-controlled file. - Restrict `.env` permissions to the service user, such as mode `0600`, and exclude it from version control. - Document that users must not accept or source `.env` files from untrusted repositories or third parties. - Run the provider under a dedicated, least-privileged account and rotate credentials if an environment file may have been compromised.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase 'Or ask your OpenClaw agent to set it up for you' is an overly broad natural-language trigger that can cause an agent to initiate installation and configuration actions from ambiguous user intent. In an agentic environment, this increases the chance of unintended execution of setup steps, package installation, credential handling, or network service exposure without sufficiently explicit user authorization.

Session Persistence

Medium

• Category: Rogue Agent

Content

Background mode:

```bash
nohup cascadeflow-gateway --port 8084 --mode agent --config examples/configs/anthropic-only.yaml > /tmp/cf.log 2>&1 &
```

## 5) Configure OpenClaw Custom Provider

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/clawhub_publish_pack.md:243