AI 价格计算器

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

The skill itself is a simple AI model cost calculator, but it recommends running an unpinned external installer script that was not included for review.

Review the skill as a local cost-estimation helper, but avoid the recommended openclaw-cn-installer path unless you independently trust and verify that separate skill and the clawhub version being executed. Prefer manual OpenClaw configuration or pinned, reviewed installer versions. Also confirm current provider pricing because the costs are hardcoded and may be outdated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: recommend.js:181

Finding

Unpinned External Skill Installation and Execution

Content

View full analysis

Vulnerability Details

File Locations:

• recommend.js:181-182
• SKILL.md:212-213

Vulnerability Type: Unreviewed and unpinned external dependency execution
Risk Level: Medium

Code Snippet — recommend.js:181-182:

js

console.log('     npx clawhub@latest install openclaw-cn-installer');
console.log(`     node ~/.openclaw/skills/openclaw-cn-installer/setup-ai.js ${MODELS[scenario.recommend].provider}`);

Code Snippet — SKILL.md:212-213:

bash

npx clawhub@latest install openclaw-cn-installer
node ~/.openclaw/skills/openclaw-cn-installer/setup-ai.js deepseek

Technical Analysis

The Skill recommends downloading openclaw-cn-installer through the mutable clawhub@latest package and then directly executing the downloaded setup-ai.js script. The external installer and its transitive dependencies are not included in this project, pinned to a reviewed version, or protected by an integrity value.

Consequently, the code ultimately executed by a user can change after this Skill has been audited. Although the local scripts do not automatically execute the installer, the recommendation workflow explicitly presents these commands as the primary configuration method. If the package registry, publisher account, external Skill, or one of its dependencies is compromised, following the displayed instructions could execute attacker-controlled JavaScript.

Attack Path

1. An attacker compromises the package publisher, registry entry, external installer Skill, or a dependency used by the installer.
2. The attacker publishes a malicious version that can be resolved through clawhub@latest or modifies the externally retrieved setup-ai.js.
3. A user runs recommend.js and receives the installation and execution commands as trusted setup guidance, or follows the same instructions in SKILL.md.
4. The user downloads the mutable external component with `npx clawhub@latest ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the external installer recommendation where possible and make the documented manual configuration procedure the default.
2. If the installer is required, pin both the CLI and installer Skill to exact, reviewed versions rather than using @latest.
3. Verify downloaded artifacts with a cryptographic digest or signed release metadata before execution.
4. Vendor the reviewed installer logic into the project when licensing permits, so its complete behavior is included in future audits.
5. Review and lock all transitive dependencies associated with the installer.
6. Clearly disclose that the installer is third-party code and require users to inspect it before execution.
7. Run configuration tooling with least privilege and never recommend sudo or administrator execution.
8. Prefer a constrained configuration writer that validates allowed provider and model values and only modifies the intended configuration fields.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code does perform API cost calculation, which matches part of the description. However, the declared primary value proposition includes automatically recommending the optimal model and comparing DeepSeek/智谱/通义/GPT costs more generally. The supplied code does not implement recommendation logic, ranking, or multi-model comparison; it only computes cost for one chosen model and optionally shows savings versus GPT-4o. This is a meaningful description-versus-behavior mismatch, though not a security/resource mismatch. The inclusion of Claude models is a minor scope difference rather than the main issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing natural-language content entirely in Chinese, including the description, usage instructions, examples, and FAQs. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version without pinning. If the upstream package is compromised or a malicious version is published later, users running the documented command could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command again instructs users to run npx clawhub@latest, which implicitly trusts whatever version is current at execution time. That creates a supply-chain risk because a future compromised release could lead to arbitrary code execution during setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code contains natural-language strings and comments such as '计算特定模型的 API 费用', '未知模型', and usage examples entirely in Chinese, which effectively forces a specific language for interaction. The file does not offer an English alternative, user opt-in, or any documented justification for the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file description is written as a Chinese-only statement ('对比不同 AI 模型的 API 价格') and the program's user-facing output is entirely in Chinese, indicating a fixed language choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s natural-language description and user-facing prompts are presented in Chinese, starting with the header comment and continuing throughout the CLI interaction. Because the skill does not offer an opt-in language selection or explain that it is intentionally region-specific, this can violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script instructs users to run npx clawhub@latest install openclaw-cn-installer, which fetches and executes remote package code without pinning to a reviewed version. If the package is compromised, typosquatted, or a malicious update is published, users could execute attacker-controlled code on their system; the risk is elevated because this tool explicitly tells users to run the command as part of setup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is inconsistent with the stated purpose of the skill, describing it only as a generic productivity tool rather than an AI cost optimizer. This can mislead users and any automated review or routing systems about what the skill actually does, reducing transparency and making inappropriate activation or trust decisions more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A broad, vague description fails to establish a clear activation scope, which may cause the skill to be invoked in contexts unrelated to cost optimization. In agent ecosystems, ambiguous scope increases the chance of overbroad use and user confusion, especially when multiple skills compete for selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description uses Chinese text exclusively, which can impose a specific language on users without any stated opt-in or explanation of locale restrictions. Under the policy, language constraints should either be optional for the user or clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.