RealmRouter Switch

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:25 AM UTC
• Version: 2.1.0

Overview

This appears to be a real RealmRouter/OpenClaw configuration helper, but it warrants Review because it handles API keys and can automatically change OpenClaw config and restart the gateway with limited warnings.

Review before installing. Use a pinned, trusted ClawHub installer version where possible, avoid running the Windows install with administrator privileges unless required, and understand that using this skill can store your RealmRouter API key in OpenClaw config and backup files, change your default model, and restart the OpenClaw gateway.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45 and SKILL.md:72
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete vulnerable code snippet:

bash

npx clawhub install realmrouter-switch --force

The same command is documented for both macOS/Linux and Windows installations.

Technical Analysis

The installation instructions invoke clawhub through npx without specifying an exact package version or integrity value. Depending on the local npm configuration and cache state, npx can retrieve and execute the package currently resolved by the configured registry. Consequently, the executed installer can differ from the version originally reviewed.

The --force option further increases the impact by allowing the command to replace an existing Skill installation. There is no evidence in the audited project that the referenced package is currently malicious; the vulnerability is the mutable and insufficiently verified supply-chain boundary.

Attack Path

1. An attacker compromises the package publication account, registry, package distribution infrastructure, or another component involved in resolving the unpinned clawhub package.
2. The attacker publishes a malicious or modified version under the package name resolved by npx.
3. A user follows the documented installation command.
4. npx downloads and executes the attacker-controlled package with the privileges of the user running the command.
5. The malicious installer can access user-readable files, alter user-writable configuration, execute subprocesses, and replace the existing Skill because --force is supplied.

Impact Assessment

Successful exploitation provides code execution under the installing user's account. The resulting access is limited by that account's operating-system permissions, but may include OpenClaw configuration and credentials, files in the user's home directory, netwo ...[truncated 196 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to a specifically reviewed version, for example:

   bash

   npx --yes clawhub@<reviewed-version> install realmrouter-switch
   

2. Document the expected npm registry and require installation from that trusted source.
3. Where supported, verify the package using a cryptographic integrity digest or signed release before execution.
4. Remove --force from the default instructions. Reserve forced replacement for an explicit recovery or upgrade procedure after informing the user what will be overwritten.
5. Publish and verify package lock or provenance information so users can confirm that the installed artifact matches the audited release.
6. Advise users not to run the installation command with administrator or root privileges unless such privileges are demonstrably required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

macOS / Linux 安装

步骤 1: 安装 skill

bash

npx clawhub install realmrouter-switch --force

步骤 2: 安装 rr 快捷命令（可选但推荐）

bash

# 方式一：使用安装脚本
bash ~/.openclaw/workspace/skills/realmrouter-switch/scripts/install_rr.sh

# 方式二：手动添加到 PATH
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc  # 如果用 zsh
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc  # 如果用 bash
source ~/.zshrc  # 或 source ~/.bashrc

步骤 3: 验证安装

bash

rr show
# 或直接用 Python 脚本
python3 ~/.openclaw/workspace/skills/realmrouter-switch/scripts/realm_manager.py show

---

Windows 安装

步骤 1: 安装 skill

powershell

npx clawhub install realmrouter-switch --force

步骤 2: 安装 rr 快捷命令

powershell

# 以管理员权限运行 PowerShell，然后执行：
powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.openclaw\workspace\skills\rea

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that imply shell execution, file modification, environment-variable handling, and network access, but it does not declare any explicit tool scope or allowed-tools boundary. In a chat-invocable skill that can change configuration and restart services automatically, this lack of least-privilege scoping increases the chance of unintended or overbroad execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The operational instructions and suggested invocation phrases are presented only in Chinese for the primary usage flow, despite the skill metadata and title also targeting a broader cross-platform audience. This creates a language policy issue because the skill implicitly constrains interaction language without offering an opt-in or alternative language path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill defines very broad conversational triggers like 'switch model', 'set key', and 'rollback', which can cause the skill to activate during ordinary conversation rather than an intentionally scoped command flow. Because the skill claims it will automatically execute actions, unintended invocation could lead to configuration changes, secret handling, or service restarts without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation instructs users to provide API keys directly in chat or commands but does not give an explicit warning about sensitive secret handling, storage, masking, or transcript exposure. In a chat-first workflow, this increases the risk of users pasting secrets into logs, history, or interfaces that are not intended for secure secret entry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill states that it will automatically execute all operations, including restarting the gateway, but does not clearly warn about the consequences of local configuration changes, backup behavior, or rollback side effects. This is dangerous because users may trigger disruptive or state-altering actions without understanding what files or services will be changed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The installation flow invokes npx clawhub without pinning an exact package version, which can pull whatever version is current at execution time. That creates a supply-chain risk: users may install changed or compromised code unexpectedly, especially because the command is presented as a normal setup step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

This Windows installation command also uses npx clawhub without version pinning, exposing users to the same supply-chain unpredictability as the Unix flow. Because it is part of a documented install procedure, users are likely to run it without reviewing what version they received.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The example workflow repeats the unpinned npx clawhub install pattern, reinforcing insecure installation practices. Repetition increases exposure because users may copy-paste the example directly and trust it as canonical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

This repeated Windows example again relies on unpinned package execution through npx, which is a well-known supply-chain risk pattern. In a skill that can modify local config and restart components, compromise of the installer could have immediate local impact.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a chat-first RealmRouter model manager focused on API key setup, model selection, switching, rollback, and connectivity checks. Invoking subprocesses to restart a local gateway introduces process-execution capability, which is not explicitly justified by that stated purpose and is a broader operational action than mere configuration management.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/realm_manager.py (reported line 168)May include surrounding context.

python

print("Hint: run 'openclaw gateway restart' to apply changes.")
        return
    try:
        subprocess.run(["openclaw", "gateway", "restart"], check=True)
        print("OK: gateway restarted")
    except Exception as e:
        print(f"WARN: gateway restart failed: {e}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The install flow stores the RealmRouter API key directly in the user's OpenClaw JSON config on disk, creating a persistent plaintext secret that may be exposed through weak file permissions, backups, or local compromise. This is not malicious, but it increases credential exposure risk because the tool does not prominently warn the user or prefer a safer secret source.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The update-key path also writes the supplied API key to the configuration file, again persisting a sensitive credential in plaintext and likely propagating it into backup copies. In a config-management skill, this is contextually more important because the script automatically creates backups, which broadens the number of files containing the secret.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script handles a sensitive credential by passing the provided API key to another program with set-key --api-key and also triggers --restart-gateway. Although there is a usage message for missing arguments, there is no confirmation, warning, or explanatory comment disclosing that a secret is being processed and that service state will be changed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rr_win.py (reported line 13)May include surrounding context.

python

def run(args):
    cmd = [sys.executable, str(PY), *args]
    return subprocess.call(cmd)


def main():