Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed cost-optimization helper that runs local recommendation scripts and read-only usage analytics, with no evidence of hidden execution, exfiltration, destructive behavior, or persistence.
Install only if you want a cost-optimization helper for openclaw-manager. Review generated AGENTS.md.optimized before applying it, and run the database-backed report/advisor commands only in an environment where reading instance usage and quota data is appropriate.
Although this specific static finding text appears internally inconsistent, it still points to the same underlying problem: the skill's declared behavior is not reliably aligned with what is implemented. Ambiguous or contradictory manifests are hazardous in agent systems because they impair review, make policy enforcement harder, and can conceal side effects or unsupported actions behind marketing-style descriptions.
Although this specific static finding text appears internally inconsistent, it still points to the same underlying problem: the skill's declared behavior is not reliably aligned with what is implemented. Ambiguous or contradictory manifests are hazardous in agent systems because they impair review, make policy enforcement harder, and can conceal side effects or unsupported actions behind marketing-style descriptions.
Although this specific static finding text appears internally inconsistent, it still points to the same underlying problem: the skill's declared behavior is not reliably aligned with what is implemented. Ambiguous or contradictory manifests are hazardous in agent systems because they impair review, make policy enforcement harder, and can conceal side effects or unsupported actions behind marketing-style descriptions.
Although this specific static finding text appears internally inconsistent, it still points to the same underlying problem: the skill's declared behavior is not reliably aligned with what is implemented. Ambiguous or contradictory manifests are hazardous in agent systems because they impair review, make policy enforcement harder, and can conceal side effects or unsupported actions behind marketing-style descriptions.
Although this specific static finding text appears internally inconsistent, it still points to the same underlying problem: the skill's declared behavior is not reliably aligned with what is implemented. Ambiguous or contradictory manifests are hazardous in agent systems because they impair review, make policy enforcement harder, and can conceal side effects or unsupported actions behind marketing-style descriptions.
The metadata {"openclaw": {"always": true}} appears to force unconditional activation, effectively bypassing least-privilege skill selection. In agent environments, always-on skills with broad descriptions are especially dangerous because they can influence unrelated tasks, capture more context than necessary, and exercise latent side effects without a narrowly scoped invocation decision.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
from model_router import route
if not args:
print("用法: cli.py route <prompt> [provider]")
return
prompt = args[0]
provider = args[1] if len(args) > 1 else "zai-proxy"
result = route(prompt, provider)
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
from model_router import route
if not args:
print("用法: cli.py route <prompt> [provider]")
return
prompt = args[0]
provider = args[1] if len(args) > 1 else "zai-proxy"
result = route(prompt, provider)
The skill advertises or implies file-writing behavior by generating an optimized AGENTS.md, yet the manifest declares no explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations can let a broadly-triggered skill perform filesystem changes without clear user awareness or policy enforcement, increasing the chance of unauthorized prompt/instruction modification.
The invocation text uses broad trigger language such as 'anything related' and similar catch-all phrasing, which can cause the skill to activate in many contexts beyond its safe or intended scope. Overbroad activation increases the chance of prompt hijacking of workflow selection, accidental access to sensitive project context, and unreviewed execution of side-effecting features like file generation.
The module docstring and command descriptions are presented in Chinese, and the rest of the CLI continues this pattern in user-facing help and error messages. For a general-purpose CLI, this imposes a specific language without user opt-in or an explicit region-specific justification, which matches the language/locale policy violation criteria.
Usage strings, help output, and unknown-command messaging are all emitted in Chinese, with no mechanism for the user to choose another language. This is a natural-language policy concern because the skill enforces a locale choice rather than offering one.
The top-level docstring states '纯本地运行，无网络请求，无副作用' ('local only, no network requests, no side effects'). However, the generate-agents command writes AGENTS.md.optimized to disk, which is a clear side effect. This is an active contradiction between documentation and code behavior, not merely omitted detail.
The generated natural-language instructions include '强制执行' and prescribe fixed model choices for conversation types, while the file and comments are entirely Chinese with no indication of user choice of language or locale. This creates a policy concern because the skill emits organizational instructions in a forced form rather than offering an opt-in language/locale or documented justification.
This Python file contains natural-language docstrings and CLI usage/help text exclusively in Chinese, including the main description and command guidance. Under the policy rule, forcing a specific language without opt-in or documented justification is a natural-language policy violation.
The command usage, examples, and unknown-command message shown to users are all Chinese-only. Because the file does not offer a language choice or state a justified locale constraint, this conflicts with the language/locale policy criteria.
The module docstring is entirely in Chinese and presents the skill's purpose and usage only in that language. This creates a locale/language constraint without indicating user choice, opt-in, or a documented region-specific justification.
This Python file contains its primary docstring, error output, and CLI usage text exclusively in Chinese, which imposes a specific language on users. The file does not provide an opt-in language choice or indicate that the skill is intentionally limited to a Chinese-speaking or region-specific context.
The top-level documentation states the patch adjusts the heartbeat interval to 55 minutes, implying a fixed recommendation. However, show_recommendation derives a different interval as cache_ttl_minutes - 5 and includes that computed value in the generated config_patch, so the documentation does not accurately reflect actual behavior.
The module docstring is entirely in Chinese and states the skill behavior only in that language, and the user-facing CLI usage/output strings are also Chinese. This creates a locale constraint in natural-language interaction without offering a user choice or documenting that the skill is intentionally region-specific.
The module docstring at L010 says the tool has 'no side effects' (无副作用), but the file's main entrypoint prints usage/results and may call sys.exit(1). While these are minor CLI side effects rather than security-relevant external actions, the inline documentation still overstates the behavior and contradicts what the script actually does when executed as a program.
No suspicious patterns detected.