发现、对比和配置多平台免费/低价 AI 模型

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:48 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent model-management helper, but it can rewrite OpenClaw model configuration and encourages storing provider API keys without enough confirmation, rollback, or credential-handling guidance.

Review the exact changes before using `free-model-finder auto` or `switch`, and back up `~/.openclaw/openclaw.json` first. Only configure your own provider API keys, assume `openclaw config set env.*` stores sensitive credentials locally, and avoid the unpinned `npx ...@latest` install example unless you trust the current package source.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

Thumbs.db

# Config (optional - include if you want to share defaults)
# .env

# Logs
*.log

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The documentation instructs users to run `npx clawhub@latest install free-model-finder`, which executes code fetched at install time without pinning a specific version. If the upstream package is compromised or a breaking/malicious version is published, users may execute unintended code on their systems. In this context, the risk is real because the file is an installation guide that directly encourages copy-paste execution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file includes commands to save provider API keys via `openclaw config set env.*` but does not disclose how those secrets are stored or advise users to protect them. Because API credentials are sensitive, the skill description should include a brief warning about secure handling and storage before asking users to enter them.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly advertises direct modification of the OpenClaw configuration file and automatic Gateway restart, but it does not state that these are system-impacting actions requiring explicit user confirmation. Even in a legitimate automation skill, silent config changes and service restarts can disrupt running workloads, alter model routing unexpectedly, or overwrite a user's intended settings.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The title and all user-facing CLI text in this file are presented in Chinese, with no indication that another language is available or that the locale is intentionally limited. This can violate language/locale policy when the skill imposes a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code writes directly to the user's OpenClaw configuration file and only informs the user after the write has already occurred. For a code file, file modification is a safety-relevant operation and there is no confirmation prompt or pre-action disclosure near the write path itself.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest explicitly advertises that it can '自动配置最优性价比模型' but does not document what command triggers this behavior, what files are modified, or whether the user must confirm changes before local configuration is rewritten. In a skill that targets OpenClaw configuration, ambiguous automation increases the risk of unexpected state changes, model/provider switching, or silent reconfiguration of agent defaults.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest promotes automatic configuration and model switching, and also declares a concrete OpenClaw config path plus keys that may be changed, but it does not warn users that local configuration will be modified. This can lead to silent or surprising changes to agent behavior, including switching to different remote providers, affecting privacy, cost, or reliability.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown file contains user-facing instructions only in Chinese, and does not indicate that other languages are available or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file presents all installation and usage instructions in Chinese with no indication that other languages are available or that Chinese is required for a documented reason. This can constitute a language-policy issue because it forces a specific language without user opt-in.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The markdown describes `free-model-finder auto` and `openclaw gateway restart` as routine steps, but it does not explicitly warn that the skill will change current model configuration and affect subsequent sessions. This is a user-impacting configuration change, so a short disclosure would help users understand the operational effect before running it.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill describes daemonized monitoring and automatic model rotation that can continuously change runtime behavior after initial setup, but it does not warn users that the system may autonomously switch models over time. This can lead to unexpected behavior, cost, privacy, compliance, or reliability changes if requests are routed to different providers without ongoing user awareness.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: 该 markdown 文件标题及全文均以中文呈现，没有说明这是面向特定中文用户群体的区域性文档，也未提供用户可选择其他语言的说明。根据规则，若技能或相关文档强制特定语言而无用户选择或合理限定，可构成自然语言层面的语言/地区政策问题。

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The CLI help text says the command will '刷新模型缓存（暂未实现）', and the runtime output says '模型缓存已刷新', which implies the action succeeded. In reality, the code executes no cache refresh logic at all and only prints a message, creating a direct mismatch between the stated effect and actual behavior.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The package metadata description is written only in Chinese ("多平台免费/低价 AI 模型发现与配置工具"), which may indicate a language-specific user-facing experience without any opt-in or alternative locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The display name and description include Chinese-language text, but the manifest does not indicate whether the skill targets Chinese-speaking users specifically or whether other language options are supported. This can amount to an implicit language preference without explicit user opt-in or documented locale scope.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill requests multiple API credentials for third-party AI providers but does not include a privacy or data-handling notice explaining how keys are stored, used, transmitted, or whether they are logged. In a multi-provider model-selection skill, undeclared credential handling raises the risk of accidental exposure or user misunderstanding about which services receive secrets and traffic.

Static analysis

No suspicious patterns detected.