ClawHub
Back to skill

Security audit

Add Siliconflow Provider 1

Security checks for vulnerabilities and agentic risk

Overview

The skill is a visible SiliconFlow setup guide, but it needs review because broad triggers and default fallback changes could route future OpenClaw prompts and API keys to a third-party provider without strong scoping or secret-handling guidance.

Install only if you intentionally want OpenClaw configured to use SiliconFlow. Review the fallback-chain change before applying it, use a protected environment variable or secret store for the API key where possible, avoid testing with sensitive prompts, and keep the backup so the provider can be removed if it was added unintentionally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

External Script Fetching

High
Category
Supply Chain
Content
### 验证 API Key

```bash
curl -s 'https://api.siliconflow.cn/v1/user/info' \
  -H 'Authorization: Bearer <YOUR_API_KEY>' | python3 -m json.tool
```
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
### 查询余额

```bash
curl -s 'https://api.siliconflow.cn/v1/user/info' \
  -H 'Authorization: Bearer <API_KEY>' | python3 -c "
import json,sys; d=json.load(sys.stdin)['data']
print(f'充值余额: ¥{d[\"chargeBalance\"]}')
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# 所有 chat 模型
curl -s 'https://api.siliconflow.cn/v1/models?sub_type=chat' \
  -H 'Authorization: Bearer <API_KEY>' | python3 -c "
import json,sys
models = json.load(sys.stdin)['data']
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill description is written entirely in Chinese and does not indicate that other languages are supported or that Chinese is a deliberate region-specific requirement. This can constitute a language/locale policy issue because the skill appears to impose a specific language without user opt-in.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are overly broad and include generic requests like adding free models, Qwen, or Kimi, which can cause this skill to activate for unrelated model-management tasks. That increases the chance an operator applies SiliconFlow-specific configuration when another provider or safer workflow was intended, leading to misconfiguration and unintended third-party integration.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|
| Provider 名称 | `siliconflow` |
| API 协议 | `openai-completions` |
| Base URL | `https://api.siliconflow.cn/v1` |
| 认证方式 | Bearer Token (API Key) |

---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs users to send a bearer API key to an external service but does not include an explicit warning about handling secrets, verifying the endpoint, or avoiding logging/shell history exposure. In an agent-skill context, normalizing secret-bearing curl commands without safeguards raises the risk of credential leakage and accidental transmission to third parties.

External Transmission

Medium
Category
Data Exfiltration
Content
### 验证 API Key

```bash
curl -s 'https://api.siliconflow.cn/v1/user/info' \
  -H 'Authorization: Bearer <YOUR_API_KEY>' | python3 -m json.tool
```
Confidence
82% confidence
Finding
The command sends a bearer token to an external endpoint without surrounding guidance on secret hygiene, endpoint verification, or safe execution practices. In a skill meant to be copied by administrators, this increases the chance of API key exposure through shell history, logs, screenshots, or use in untrusted environments.

External Transmission

Medium
Category
Data Exfiltration
Content
"models": {
    "providers": {
      "siliconflow": {
        "baseUrl": "https://api.siliconflow.cn/v1",
        "apiKey": "<YOUR_API_KEY>",
        "api": "openai-completions",
        "models": [
Confidence
78% confidence
Finding
The configuration example embeds the API key directly in a JSON file under apiKey, which encourages storing long-lived credentials in plaintext on disk. If the OpenClaw config is readable by other local users, copied into backups, or committed accidentally, the provider credential can be exposed.

External Transmission

Medium
Category
Data Exfiltration
Content
### 查询余额

```bash
curl -s 'https://api.siliconflow.cn/v1/user/info' \
  -H 'Authorization: Bearer <API_KEY>' | python3 -c "
import json,sys; d=json.load(sys.stdin)['data']
print(f'充值余额: ¥{d[\"chargeBalance\"]}')
Confidence
81% confidence
Finding
This example transmits a bearer token to an external service and encourages inline use in a shell command. Even though the endpoint is expected, the lack of secret-handling guidance makes accidental credential disclosure more likely in terminals, process listings, logs, or shared troubleshooting output.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 所有 chat 模型
curl -s 'https://api.siliconflow.cn/v1/models?sub_type=chat' \
  -H 'Authorization: Bearer <API_KEY>' | python3 -c "
import json,sys
models = json.load(sys.stdin)['data']
Confidence
80% confidence
Finding
The model-listing example also sends a bearer token externally without any privacy or credential-safety warning. While the request is functionally legitimate, the documentation pattern normalizes potentially unsafe secret handling for administrators.

External Transmission

Medium
Category
Data Exfiltration
Content
### 测试模型

```bash
curl -s 'https://api.siliconflow.cn/v1/chat/completions' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
77% confidence
Finding
The test completion command sends both an API key and prompt content to a third-party inference service. In this skill context, the absence of a warning not to use sensitive data for testing makes accidental disclosure of internal prompts or data more likely.

External Transmission

Medium
Category
Data Exfiltration
Content
### 测试模型

```bash
curl -s 'https://api.siliconflow.cn/v1/chat/completions' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
Confidence
77% confidence
Finding
The test completion command sends both an API key and prompt content to a third-party inference service. In this skill context, the absence of a warning not to use sensitive data for testing makes accidental disclosure of internal prompts or data more likely.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The skill content, invocation guidance, and operational steps are all presented only in Chinese, which effectively imposes a language requirement without user opt-in. No justification or note indicates that this skill is intentionally limited to Chinese-speaking administrators or a China-specific environment.

Static analysis

No suspicious patterns detected.