cascadeflow: Cost + Latency Reduction

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:21 PM UTC
• Version: 1.1.1

Overview

CascadeFlow is a coherent OpenClaw provider skill, but it asks users or agents to install and run a credential-bearing local service using unsafe setup patterns that deserve review before installation.

Review the setup commands before allowing an agent to run them. Prefer an exact reviewed CascadeFlow version with trusted hashes or a lock file, do not source untrusted .env files, keep the server on localhost unless you configure TLS and strong tokens, and use limited-scope API keys with spending limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Third-Party Package Installation Without Trusted Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-55, SKILL.md:60-62, references/clawhub_publish_pack.md:63-76
Vulnerability Type: Insecure dependency installation and ineffective artifact verification
Risk Level: Medium

Vulnerable Code

SKILL.md:51-55:

bash

python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade "cascadeflow[openclaw]>=0.7,<0.8"
python -m pip show cascadeflow
python -m pip download --no-deps "cascadeflow[openclaw]>=0.7,<0.8" -d /tmp/cascadeflow_pkg
python -m pip hash /tmp/cascadeflow_pkg/cascadeflow-*.whl

references/clawhub_publish_pack.md:63-76:

bash

python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade "cascadeflow[openclaw]>=0.7,<0.8"
python -m pip show cascadeflow
python -m pip download --no-deps "cascadeflow[openclaw]>=0.7,<0.8" -d /tmp/cascadeflow_pkg
python -m pip hash /tmp/cascadeflow_pkg/cascadeflow-*.whl

bash

# Anthropic-only preset users
python -m pip install --upgrade "cascadeflow[openclaw,anthropic]>=0.7,<0.8"

# OpenAI-only preset users
python -m pip install --upgrade "cascadeflow[openclaw,openai]>=0.7,<0.8"

# Mixed preset users (OpenAI + Anthropic + common providers)
python -m pip install --upgrade "cascadeflow[openclaw,providers]>=0.7,<0.8"

Technical Analysis

The installation instructions accept any cascadeflow release in the 0.7.x range rather than an exact, previously audited version. They also permit resolution and installation of transitive dependencies without a lock file or trusted hash set.

Running pip hash after downloading an artifact only calculates the digest of the artifact that was retrieved. The instructions do not compare that digest against an independently distributed trusted value, so this step cannot detect a compromised package repository, malicious release, or substituted artifact. In a ...[truncated 1543 chars]

Remediation

View remediation

Remediation Suggestions

• Pin CascadeFlow to an exact, reviewed version instead of a version range.
• Lock every transitive dependency using a reproducible lock file.
• Publish trusted SHA-256 values through a channel independent of the package artifact.
• Download artifacts before installation, verify them against the trusted digest, and abort on mismatch.
• Install using pip --require-hashes and a fully hashed requirements file.
• Avoid --upgrade in automated Agent instructions unless an explicit update review is performed.
• Use a dedicated virtual environment and a least-privileged service account.
• Provide provenance or signature-verification instructions where supported.
• Ensure provider keys available to the service have minimal permissions, quotas, and rotation procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Arbitrary Shell Execution Through Sourcing of Environment Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73, references/clawhub_publish_pack.md:107, references/clawhub_publish_pack.md:121
Vulnerability Type: Unsafe interpretation of configuration data as shell code
Risk Level: Medium

Vulnerable Code

SKILL.md:73:

bash

set -a; source .env; set +a

references/clawhub_publish_pack.md:107:

bash

set -a; source .env; set +a

references/clawhub_publish_pack.md:121:

bash

set -a; source .env; set +a

Technical Analysis

The shell built-in source evaluates the contents of .env as shell syntax. A dotenv file is therefore not treated solely as a collection of key-value records: command substitutions, function definitions, redirections, pipelines, and arbitrary commands are executed by the current shell.

For example, a malicious entry such as TOKEN=$(malicious-command) would execute the command while the file is sourced. Since the same shell immediately launches the provider, injected code can also alter exported variables, executable search paths, or other process settings.

This issue requires the .env file or its creation workflow to be influenced by an attacker. It does not independently grant access to an attacker who cannot control that file.

Attack Path

1. An attacker supplies, modifies, or causes the user to copy an untrusted .env file into the working directory.
2. The user or setup Agent follows the documented server-start procedure.
3. The current shell executes source .env.
4. Shell expressions and commands embedded in .env execute with the launching user's privileges.
5. The injected commands can read local files, capture provider keys, alter the environment, or replace the command that is subsequently resolved and launched.
6. Stolen data can be transmitted using any network access already available to the user process.

Impact Assessment

Exploitation provides arbitrary command ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

• Do not load dotenv configuration with source, ., or another shell evaluator.
• Parse .env using a dotenv library that treats entries as data and rejects shell expressions.
• Allowlist expected names such as OPENAI_API_KEY and ANTHROPIC_API_KEY.
• Reject malformed entries, command substitutions, unexpected variable names, and embedded control characters.
• Prefer a service manager or secrets facility that injects credentials without evaluating a project-controlled file.
• Restrict .env permissions to the service user, such as mode 0600, and exclude it from version control.
• Document that users must not accept or source .env files from untrusted repositories or third parties.
• Run the provider under a dedicated, least-privileged account and rotate credentials if an environment file may have been compromised.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase 'Or ask your OpenClaw agent to set it up for you' is an overly broad natural-language trigger that can cause an agent to initiate installation and configuration actions from ambiguous user intent. In an agentic environment, this increases the chance of unintended execution of setup steps, package installation, credential handling, or network service exposure without sufficiently explicit user authorization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/clawhub_publish_pack.md (reported line 142)May include surrounding context.

Background mode:

bash

nohup cascadeflow-gateway --port 8084 --mode agent --config examples/configs/anthropic-only.yaml > /tmp/cf.log 2>&1 &

5) Configure OpenClaw Custom Provider

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/clawhub_publish_pack.md:243