T09 · Insecure Skill Coding Practices
Error
- Location
scripts/manage_models.py:679- Finding
Weak URL Validation Can Redirect Credentials and Model Traffic to an Attacker-Controlled Host
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart Model Router
Security checks for vulnerabilities and agentic risk
Overview
This skill is review-worthy because it persistently changes OpenClaw model settings, stores an API key, and bundles unrelated local file-reading utilities.
Install only if you are comfortable letting the skill modify your OpenClaw configuration, store a TokenRouter API key locally, add remotely listed models to your allowed list, and generate persistent workflow files. Verify the provider URL carefully, avoid passing secrets through command-line history where possible, and consider removing or ignoring the bundled smart_find.py and smart_map.py utilities unless you explicitly need local file inspection.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/manage_models.py:738- Finding
API Key Exposure Through Command-Line Arguments and Insufficient File Permission Enforcement
- Content
View full analysis
12 else f" apiKey: (set)" ) return True except Exception as e: print(f"❌ [Setup] Failed to write config: {e}") return False ``` The Skill explicitly documents passing the secret on the command line: ```text setup --name --base-url --api-key ``` ### Technical Analysis Command-line arguments are an unsafe secret ...[truncated 2180 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/manage_models.py:816- Finding
Untrusted Remote Model Data Is Automatically Granted Global Routing Permissions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/smart_find.py:15- Finding
Unrestricted Fuzzy File Search Can Disclose Local File Contents Outside the Skill's Declared Scope
- Content
View full analysis
0.2 if score > 0.2: matches.append((full_path, score)) except Exception as e: print(f"Error while searching: {str(e)}", file=sys.stderr) return [] # Sort by score (highest first) and path length (shortest first) matches.sort(key=lambda x: (-x[1], len(x[0]))) return matches ``` ```python def read_file_content(file_path): """Read and return file content safely.""" try: with open(file_path, 'r', encoding='utf-8') as f ...[truncated 3264 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill's stated purpose does not clearly disclose that it will write provider credentials into local config, create backups, modify model allow-lists, and generate execution-plan files. Hidden persistence and credential handling in a skill framed as optimization/routing materially raises security risk because users may not realize they are authorizing sensitive local changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill's stated purpose does not clearly disclose that it will write provider credentials into local config, create backups, modify model allow-lists, and generate execution-plan files. Hidden persistence and credential handling in a skill framed as optimization/routing materially raises security risk because users may not realize they are authorizing sensitive local changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated purpose does not clearly disclose that it will write provider credentials into local config, create backups, modify model allow-lists, and generate execution-plan files. Hidden persistence and credential handling in a skill framed as optimization/routing materially raises security risk because users may not realize they are authorizing sensitive local changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated purpose does not clearly disclose that it will write provider credentials into local config, create backups, modify model allow-lists, and generate execution-plan files. Hidden persistence and credential handling in a skill framed as optimization/routing materially raises security risk because users may not realize they are authorizing sensitive local changes.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The implementation materially differs from the declared skill purpose: instead of model routing or pricing-based orchestration, it performs fuzzy local file discovery and prints file contents. In an agent setting, hidden file-reading behavior that is unrelated to the advertised function is dangerous because it can expose workspace data and mislead reviewers or users about the capability being granted.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest describes a 'Smart Model Router' that routes tasks to cost-effective models, builds tiers from live pricing, classifies tasks, and orchestrates fallback workflows. This file instead walks local directories, parses Python files with the AST module, and prints a markdown 'cognitive map' of the codebase, which is a materially different capability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The changelog is written entirely in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional and documented. Under the stated policy, natural-language content that imposes a specific language without opt-in is a locale-policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to read and write local configuration files and contact a remote service, but it declares no explicit tool scope or permission boundaries. That makes the skill capable of sensitive filesystem and network actions without transparent consent controls, increasing the chance of unintended credential exposure or unauthorized config changes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill directs the agent to collect a real API key from the user and persist it into ~/.openclaw/openclaw.json. Persisting secrets in a general config file creates session-to-session credential retention and raises the risk of later disclosure, misuse, or accidental inclusion in backups.
- Content
md 3. **If found** → Skip to **Phase 3** (the provider is already configured). 4. **If NOT found** → Proceed to **Phase 2**. ### Phase 2: Guide User & Write Configuration When no TokenRouter provider is detected, the agent should:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill says model sync will automatically update the provider's models array and the global allowed-model list, but it does not require a clear, fresh user confirmation immediately before those local config changes. Automatic allow-list modification can widen model access and persist unexpected state in the user's environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Get routing recommendations for a task (Chinese or English) # NOTE: This will automatically sync models before planning write a Python script 帮我开发一个用户管理后端接口 analyze and compare the data reports of three competing products 把这段中译英
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The execute path writes a persistent swarm_plan.json file into ~/.openclaw/workspace for later consumption by the host agent. Because the file contains task prompts and execution instructions derived from task input and local prompt files, it creates a persistence channel that can influence later agent actions and may expose sensitive task content if other processes can read or tamper with the workspace.
- Content
python } ) # Write to workspace file for the host agent to pick up plan_path = os.path.expanduser("~/.openclaw/workspace/swarm_plan.json") plan_dir = os.path.dirname(plan_path) if not os.path.exists(plan_dir):
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script is advertised as a model router/planner, but the setup path writes provider configuration and credentials into ~/.openclaw/openclaw.json. That expands scope from advisory routing into privileged local configuration mutation, which can change future agent behavior and persist sensitive settings beyond the immediate task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
setup_provider() accepts a user-supplied API key and stores it in plaintext in the local OpenClaw config file. Persisting credentials is sensitive behavior and is not strictly necessary for merely evaluating routes or prices; if the config file is readable by other local processes or users, the key can be exposed and abused.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The planning workflow calls prepare_for_planning(), which fetches remote model data and then rewrites the local config by updating providers, allowed models, and potentially the default model. Users invoking 'plan' would reasonably expect only a computed routing decision, not persistent side effects that alter future runtime behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The docstring explicitly states 'Enhanced task classification with Chinese + English keyword scoring,' and the implementation only contains English and Chinese keyword lists. This creates a language/locale constraint in natural-language handling without offering user opt-in or documenting broader language support limitations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says this skill routes tasks to cost-effective models, builds model tiers from pricing, classifies tasks, and orchestrates fallback. In this file, the documented roles and task templates instead instruct agents to design software, write code and tests, audit generated files, and create planning/content documents, which is a materially different behavior than model selection or routing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The role prompts authorize broad task execution such as reading local files, writing arbitrary project artifacts, and implementing user-described tasks without explicit scope limits, safety boundaries, or exclusions. In an agent environment, overly permissive prompts can enable misuse, including unintended file access, unsafe code generation, or execution planning beyond the intended model-routing function.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function reads and returns arbitrary local file contents selected by a fuzzy search, which can expose sensitive files such as configs, source code, secrets, or private documents. Because the skill is described as an API cost/model router, this capability is unjustified by context and therefore more suspicious and risky than if it were part of a clearly documented file-inspection tool.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The docstring says the script 'Creates a high-level summary of a Python codebase using AST analysis.' In practice, generate_markdown walks the entire target directory tree, lists every non-skipped file and directory, and only uses AST analysis for .py files, so the documentation understates the breadth of filesystem enumeration.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The
--executemode writes a JSON plan to ~/.openclaw/workspace/swarm_plan.json and stdout without a prominent warning about filesystem output. Even if low risk, silent workspace writes can leak task details, create unexpected artifacts, and surprise users in sensitive environments.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This code writes a new JSON file to ~/.openclaw/workspace/swarm_insights.json, which affects user data on disk. Although the final print confirms the save after it happens, there is no upfront warning, docstring, or explanatory comment disclosing that the script will create or overwrite this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Several task templates require fixed English file names and English section labels such as 'SPEC.md', 'Project Structure', 'AUDIT.md', 'Pass/Fail', 'PLAN.md', and 'RESULT.md'. This imposes a language/locale choice without any opt-in or justification, which is a natural-language policy concern under the locale rule.
- Content
Static analysis
No suspicious patterns detected.