MLX Local AI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:06 PM UTC
• Version: 1.0.1

Overview

This skill mostly matches a local AI setup, but it has under-disclosed high-impact behaviors that should be reviewed before installation.

Review this skill carefully before installing. It may run local background AI services, modify shell startup configuration, install unpinned dependencies, download model artifacts from a third-party mirror, execute model-supplied code, and route OpenClaw requests to a remote Baidu provider unless the configuration is changed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: start_ai.sh:38

Finding

Mutable Model Payload Is Executed with Remote Code Trust Enabled

Content

View full analysis

"$LOG_DIR/chat.log" 2>&1 & ``` `SKILL.md:122-123`: ```bash source ~/mlx-env/bin/activate HF_ENDPOINT=https://hf-mirror.com python3 -c "from mlx_lm import load; load('mlx-community/Qwen3.5-4B-OptiQ-4bit')" ``` ### Technical Analysis The installer retrieves model artifacts through `hf-mirror.com`, a third-party mirror, without pinning an immutable repository revision or validating cryptographic hashes or signatures. The launcher subsequently passes `--trust-remote-code` to the model server. Remote-code trust allows custom implementation code supplied by a model repository to be imported and executed locally. Because the model reference is mutable and no integrity control is enforced, the effective executable payload can change after the Skill package has been reviewed. The local scripts can therefore app ...[truncated 1160 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: install.sh:110

Finding

Installer Executes Unpinned Python Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: start_ai.sh:55

Finding

Service Stop Operation Can Terminate Unrelated User Processes

Content

View full analysis

/dev/null; then pkill -f "mlx_lm.server" echo "✅ Chat 服务已停止" else echo "ℹ️ Chat 服务未运行" fi # 停止 Embedding 服务 if pgrep -f "embedding_server.py" > /dev/null; then pkill -f "embedding_server.py" echo "✅ Embedding 服务已停止" else echo "ℹ️ Embedding 服务未运行" fi } ``` ### Technical Analysis `pgrep -f` and `pkill -f` match text anywhere in the complete command line. The launcher does not record the process identifiers of the child processes it starts and does not verify that a matched process belongs to this installation. Any same-user process whose command line contains `mlx_lm.server` or `embedding_server.py` can therefore be selected. The stop and restart operations may terminate other projects, test processes, or unrelated services that happen to use the same module or filename. ### Attack Path 1. Another user-owned process runs with either matching string in its command line. 2. The user invokes `start_ai.sh stop`, `start_ai.sh restart`, or the uninstaller, which calls the stop action. 3. `pkill -f` selects every accessible matching process rather than only the instances created by this Skill. 4. The unrelated process receives a termination signal and stops. ### Impact Assessment The immediate impact is denial of service against unrelated processes owned by the same user. Depending on the affected application, abrupt termination could interrupt active work, corrupt partially written state, or cause loss of unsaved data. The code does not demonstrate the ability to terminate processes belonging to other users without additional privileges. ]]>

Remediation

View remediation

other

Warning

• Location: config/openclaw.json:27

Finding

Local AI Configuration Selects a Remote Provider as the Primary Model

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

./uninstall.sh

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 241)May include surrounding context.

sh

log_info "卸载..."
        rm -rf "$VENV_DIR"
        rm -f "$HOME/start_ai.sh"
        rm -f "$HOME/embedding_server.py"
        log_success "卸载完成"
        ;;
    *)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 240)May include surrounding context.

sh

rm -rf "$VENV_DIR"

echo -e "${YELLOW}删除启动脚本...${NC}"
rm -f "$HOME/start_ai.sh"

echo -e "${YELLOW}删除日志文件...${NC}"
rm -rf "$LOG_DIR"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 36)May include surrounding context.

sh

rm -rf "$VENV_DIR"

echo -e "${YELLOW}删除启动脚本...${NC}"
rm -f "$HOME/start_ai.sh"

echo -e "${YELLOW}删除日志文件...${NC}"
rm -rf "$LOG_DIR"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 45)May include surrounding context.

sh

echo -e "${GREEN}✅ 卸载完成${NC}"
echo ""
echo "注意: 模型缓存未删除，如需删除请运行:"
echo "  rm -rf ~/.cache/huggingface/hub/models--mlx-community--Qwen3.5-4B-OptiQ-4bit"
echo "  rm -rf ~/.cache/huggingface/hub/models--BAAI--bge-base-zh-v1.5"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 46)May include surrounding context.

sh

echo -e "${GREEN}✅ 卸载完成${NC}"
echo ""
echo "注意: 模型缓存未删除，如需删除请运行:"
echo "  rm -rf ~/.cache/huggingface/hub/models--mlx-community--Qwen3.5-4B-OptiQ-4bit"
echo "  rm -rf ~/.cache/huggingface/hub/models--BAAI--bge-base-zh-v1.5"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 45)May include surrounding context.

sh

echo -e "${GREEN}✅ 卸载完成${NC}"
echo ""
echo "注意: 模型缓存未删除，如需删除请运行:"
echo "  rm -rf ~/.cache/huggingface/hub/models--mlx-community--Qwen3.5-4B-OptiQ-4bit"
echo "  rm -rf ~/.cache/huggingface/hub/models--BAAI--bge-base-zh-v1.5"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 45)May include surrounding context.

sh

echo -e "${GREEN}✅ 卸载完成${NC}"
echo ""
echo "注意: 模型缓存未删除，如需删除请运行:"
echo "  rm -rf ~/.cache/huggingface/hub/models--mlx-community--Qwen3.5-4B-OptiQ-4bit"
echo "  rm -rf ~/.cache/huggingface/hub/models--BAAI--bge-base-zh-v1.5"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 46)May include surrounding context.

sh

echo ""
echo "注意: 模型缓存未删除，如需删除请运行:"
echo "  rm -rf ~/.cache/huggingface/hub/models--mlx-community--Qwen3.5-4B-OptiQ-4bit"
echo "  rm -rf ~/.cache/huggingface/hub/models--BAAI--bge-base-zh-v1.5"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file instructs users to run installation and service-management commands, and the file structure explicitly includes an uninstall script, but the README does not warn that these actions may modify the local system and start network-accessible services on ports 8080 and 8081. For markdown files, omission of warnings about behaviors affecting user data, privacy, or system integrity is in scope for SQP-2.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents all user-facing instructions in Chinese, including setup and operational steps, with no indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Chat API

bash

curl http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "mlx-community/Qwen3.5-4B-OptiQ-4bit",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation tells users to copy environment settings into shell startup files and append a source command to ~/.zshrc, creating a persistent system-wide change for that user session without any warning or rollback guidance. Persistent shell initialization changes can unintentionally alter future terminal behavior, expose secrets if sensitive variables are included, or make later troubleshooting difficult.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script automatically performs remote network actions by installing Python packages from package indexes and downloading models from a Hugging Face mirror, but it does not clearly warn the user that external downloads will occur or what hosts will be contacted. This increases supply-chain and privacy risk because users may unknowingly execute code and retrieve artifacts from third-party infrastructure during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The uninstall path deletes files and a virtual environment under the user's home directory without any confirmation prompt, dry-run, or explicit destructive-action warning. Even though the paths are fixed and quoted, accidental invocation can still cause unintended data loss or removal of locally modified files.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_deps.py (reported line 33)May include surrounding context.

python

def check_package(package_name):
    """检查 Python 包是否安装"""
    try:
        __import__(package_name)
        print(f"✓ {package_name} 已安装")
        return True
    except ImportError:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code uses Chinese-only natural-language descriptions, prompts, and status messages, including the test input sent to the API and all user-facing output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · start_ai.sh (reported line 27)May include surrounding context.

sh

echo "✅ Embedding 服务已运行 (端口 8081)"
    else
        echo "📊 启动 Embedding 服务..."
        nohup python ~/embedding_server.py > "$LOG_DIR/embedding.log" 2>&1 &
        sleep 3
        if check_embedding; then
            echo "✅ Embedding 服务启动成功"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The chat service is launched with --trust-remote-code, which permits execution of model-supplied code during model loading. In this script, the model is fetched via a mirror endpoint, so a compromised or untrusted upstream source could cause arbitrary code execution under the user account when the service starts.

Content

Scanner excerpt · start_ai.sh (reported line 41)May include surrounding context.

sh

echo "✅ Chat 服务已运行 (端口 8080)"
    else
        echo "💬 启动 Chat 服务 (mlx-community/Qwen3.5-4B-OptiQ-4bit)..."
        nohup python -m mlx_lm.server \
            --model mlx-community/Qwen3.5-4B-OptiQ-4bit \
            --trust-remote-code \
            --temp 0.3 \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's user-facing title, confirmation prompt, status messages, and completion notice are all written in Chinese. This creates a natural-language locale policy concern because users are not given any language/locale choice, and the file does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README presents all operational instructions in Chinese, including setup and publishing steps, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. The policy requires flagging language or locale constraints when they are imposed without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All prompts, status messages, and instructions are presented in Chinese, which effectively forces a single language for interaction. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language strings entirely in Chinese, beginning with the module description, and all subsequent user-facing print messages follow the same locale choice. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation because users are not given any locale selection or fallback.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's natural-language comments and all user-facing echo messages are in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. This can violate a language/locale policy that requires user choice or documented justification for a fixed locale.

Content

No source excerpt is available for this finding.