Security audit

Openclaw Model Switch

Security checks for vulnerabilities and agentic risk

Overview

This is a local OpenClaw model-configuration helper; its config edits, API key storage, and gateway restart are disclosed and aligned with that purpose, though users should treat the credential handling carefully.

Before installing, understand that this skill can change your OpenClaw model configuration, save provider API keys in plaintext in ~/.openclaw/openclaw.json, and restart the OpenClaw gateway. Use it only on an account where that local config storage is acceptable, set the config file to owner-only permissions, and be cautious about following the optional unpinned npx recommendations for other skills.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/add-model-guide.py:199
Finding: API Keys Are Echoed and Stored Without Enforced Owner-Only Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:36
Finding: Documentation Recommends Unpinned Third-Party Package Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The Chinese-language description similarly overclaims capabilities such as adding models, natural-language switching, one-click API key configuration, and intelligent model inference that are reportedly not present. Multilingual overstatement broadens the risk by misleading a wider set of users into exposing secrets or relying on nonexistent safeguards during configuration changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The Chinese-language description similarly overclaims capabilities such as adding models, natural-language switching, one-click API key configuration, and intelligent model inference that are reportedly not present. Multilingual overstatement broadens the risk by misleading a wider set of users into exposing secrets or relying on nonexistent safeguards during configuration changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The Chinese-language description similarly overclaims capabilities such as adding models, natural-language switching, one-click API key configuration, and intelligent model inference that are reportedly not present. Multilingual overstatement broadens the risk by misleading a wider set of users into exposing secrets or relying on nonexistent safeguards during configuration changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The Chinese-language description similarly overclaims capabilities such as adding models, natural-language switching, one-click API key configuration, and intelligent model inference that are reportedly not present. Multilingual overstatement broadens the risk by misleading a wider set of users into exposing secrets or relying on nonexistent safeguards during configuration changes.
Content: No source excerpt is available for this finding.

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Confidence: 85% confidence
Finding: os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
Content: Scanner excerpt · scripts/switch-model.py (reported line 50)May include surrounding context.
python
def restart_gateway(): log_info("重启网关中...") os.system('openclaw gateway restart > /dev/null 2>&1') time.sleep(3) for i in range(10): result = subprocess.run(['openclaw', 'gateway', 'status'],

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document is predominantly written in Chinese and presents the usage and safety guidance in that language, while only providing an "English Version" self-link rather than an actual alternate-language option. This can violate language/locale policy because the skill documentation effectively forces one language without user opt-in or a documented regional justification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The feature description uses natural-language triggers like "use gemini" and "切换到千问" without clarifying whether these are the exact invocation phrases, examples only, or constrained to a specific command interface. Because one example is a short everyday-style phrase in English, the README lacks specificity about trigger scope and exclusion conditions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README advertises 'Auto-configure API keys', which implies access to or modification of sensitive credentials. Although the file later says not to provide sensitive information, it does not clearly warn users that the skill may handle API keys or explain the associated privacy and security implications.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation describes capabilities that read and write local configuration files and invoke shell commands, but it declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where consumers cannot easily assess or constrain the skill's operational reach before use, increasing the chance of unintended file modification or command execution.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 149)May include surrounding context.
md
**API Key 存储方式：** - **位置：** `~/.openclaw/openclaw.json` - **格式：** 明文存储（未加密） - **权限：** 取决于文件权限（建议 `chmod 600`） **安全建议：** 1. 备份配置文件：`cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak`

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
**API Key 存储方式：** - **位置：** `~/.openclaw/openclaw.json` - **格式：** 明文存储（未加密） - **权限：** 取决于文件权限（建议 `chmod 600`） **安全建议：** 1. 备份配置文件：`cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak`

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
**API Key 存储方式：** - **位置：** `~/.openclaw/openclaw.json` - **格式：** 明文存储（未加密） - **权限：** 取决于文件权限（建议 `chmod 600`） **安全建议：** 1. 备份配置文件：`cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak`

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
**API Key 存储方式：** - **位置：** `~/.openclaw/openclaw.json` - **格式：** 明文存储（未加密） - **权限：** 取决于文件权限（建议 `chmod 600`） **安全建议：** 1. 备份配置文件：`cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak`

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The alias "flash" is overly generic and can easily collide with ordinary user language or other model naming conventions, causing the wrong model to be selected. In a skill that performs natural-language model switching, ambiguous aliases directly affect routing behavior and can silently change provider, capabilities, cost, or data-handling characteristics.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Most interactive prompts and status messages are presented only in Chinese, which imposes a specific language on all users. The file does not provide a language selection mechanism or explain that the tool is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script accepts an API key interactively and writes it into ~/.openclaw/openclaw.json without an explicit warning, consent flow, or permission hardening. Storing long-lived credentials in plaintext on disk increases exposure to local compromise, backups, other tooling, or accidental disclosure, especially in a model-switching skill that is specifically designed to manage provider secrets.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/add-model-guide.py (reported line 218)May include surrounding context.
python
switch_script = SCRIPT_DIR / "switch-model.py" if switch_script.exists(): import subprocess subprocess.run(['python3', str(switch_script), model_key]) else: print(f"{Colors.YELLOW}⚠️ switch-model.py 不存在，请手动切换{Colors.NC}") else:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code presents all user-facing messages in Chinese, including headers, status labels, and descriptions. That forces a specific language for all users without any opt-in, fallback, or documented regional justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/switch-model.py (reported line 53)May include surrounding context.
python
os.system('openclaw gateway restart > /dev/null 2>&1') time.sleep(3) for i in range(10): result = subprocess.run(['openclaw', 'gateway', 'status'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True) if 'running' in result.stdout.lower(): log_success("网关已重启完成")

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file includes a link to a Chinese version, which indicates multilingual support exists, but it does not itself force a single language or locale. Because users are given an English README here and can navigate to another language version, this is only a weak signal and likely not a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing messages at L26, L30, L33, L37-L42, and L44 are written only in Chinese. Per the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's status messages, warnings, and usage/help text are presented in Chinese throughout the file. This imposes a specific language on all users without any opt-in, selection mechanism, or documentation that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.