Huo15 Juxingyi Configure

• Outcome: Pass
• Latest audit: Jul 19, 2026 · 10:52 AM UTC
• Version: 1.3.0

Overview

This skill does what it says: it configures a Juxingyi model provider for OpenClaw, with disclosed network use, local config writes, backups, and plaintext-key tradeoffs.

Install this only if you intend to let it contact Juxingyi with your fsk- key and update your OpenClaw model configuration. Prefer the --env option if you do not want the key written directly into openclaw.json, and keep the generated backup file path so you can revert if needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly instructs users to provide an API key that will be sent to a third-party endpoint and then modifies a local configuration file under ~/.openclaw/openclaw.json, but the documentation does not clearly warn users about these external transmission and local system changes before use. This is dangerous because users may unknowingly disclose credentials to an external service and permit persistent configuration changes that affect future agent behavior.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The alias trigger "聚星逸" is a generic product name that can appear in ordinary informational conversations, so the skill may activate when the user is not actually requesting configuration or file modification. In this skill's context, unintended activation is more concerning because the documented behavior involves soliciting API keys and modifying ~/.openclaw/openclaw.json, which could lead to unnecessary sensitive-data handling or config changes.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The alias trigger "juxingyi" is broad and likely to match casual mentions of the service name, not just requests to run a configuration workflow. Because this skill can prompt for an API key and update local configuration files, accidental invocation expands the chance of collecting secrets or performing unintended state-changing actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The PRD explicitly instructs users to supply an `fsk-` API key and send it to a remote `/v1/models` endpoint, but it does not clearly warn users that their credential will be transmitted off-host and subject to the remote service's logging, retention, and privacy practices. In a configuration skill handling secrets, omission of this disclosure can cause users to expose sensitive credentials without informed consent, especially because the feature is positioned as routine and automatic.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document advertises that the skill will 'automatically write' to `~/.openclaw/openclaw.json`, but it does not present a clear upfront warning that a local configuration file will be modified. Automatic edits to security-relevant runtime configuration can change model/provider behavior, overwrite user expectations, and create persistence without sufficiently informed user consent.

Credential Access

High

• Category: Privilege Escalation

Content

console.log(`   模型数: ${textModels.length} 个文本对话模型${skipped.length ? `(跳过 ${skipped.length} 个生图/视频)` : ''}`)
  console.log(`   主模型: ${agents.primary}`)
  console.log(`   备选链: ${agents.fallbacks.length} 个模型`)
  console.log(`   密钥存储: ${flags.env ? `环境变量 ${ENV_VAR}` : '直接写入(明文)'}\n`)

  console.log('   主模型 & 备选链:')
  console.log(`   ★ ${agents.primary}`)

• Confidence: 89% confidence
• Finding: The script explicitly supports and encourages storing the API key directly in ~/.openclaw/openclaw.json in plaintext when --env is not used. That creates credential exposure risk to local users, backups, sync tools, or other software that can read the file; the surrounding skill context makes this more dangerous because the tool is specifically designed to handle live API credentials and persist them for ongoing model access.

Static analysis

No suspicious patterns detected.