Moa Publish

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.3.1

Overview

This skill does what it claims broadly, but its always-on mode can automatically send future messages to external AI providers and feed untrusted model output back into a tool-capable agent without a clear trust boundary.

Install only if you are comfortable sending prompts, code, and conversation context to the configured external model providers. Avoid persistent mode for sensitive work, disable it with /moa off when done, and do not paste secrets, regulated data, private customer information, or proprietary material unless your organization approves those providers and retention policies.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:145

Finding

Untrusted Reference Model Output Is Injected into a Tool-Capable Aggregator

Content

View full analysis

[Ref 2 / provider/model · X.Xs · rank: XX (ok)]: ... [Quality rejected: N responses filtered (too_short: N, refusal: N, api_error: N)] [User's original question]: ​``` Reference rank is an internal sort key (0-100). Quality class is the semantically meaningful label: - `good` — substantial, fast, untruncated - `ok` — usable but not exceptional - `bad` — filtered out before reaching aggregator Then respond as the aggregator: synthesize the reference perspectives, use your own judgement, and produce the final answer with normal tool access. ``` The architecture documentation confirms the relevant privilege boundary: ```markdown User question → Node.js executor calls N reference models in parallel → Collects all reference outputs + token usage + cost → Injects references into user message → Current agent (aggregator) responds with full tool access ``` ### Technical Analysis The skill forwards conversation content to external language-model providers and then places their generated output into the context of the current aggregator. The aggregator retains normal tool access. Reference output is therefore untrusted third-party content crossing into a more privileged agent context. The skill does not require references to be represented as inert data, does not define a strict instruction hierarchy around the injected content, and does not explicitly prohibit ...[truncated 2501 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:65

Finding

Persistent Mode Automatically Discloses Subsequent User Messages to External Providers

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The published description understates the behavior: the skill does far more than local aggregation, including health checks, filesystem reads, environment-based secret use, and transmission to many third-party model providers. This mismatch can mislead operators into enabling a skill with broader data exposure and connectivity than they intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Google adapter sets apiKeyInHeader=false but constructs the request URL as ?key=***)} instead of appending the real API key, so Gemini requests will fail while appearing configured. In a security-sensitive orchestration flow, this silent provider failure can reduce diversity of reference outputs and create misleading behavior or degraded safeguards if operators believe Gemini review is active when it is not.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · moa-executor.js (reported line 159)May include surrounding context.

js

The conversation below is the current state of a task handled by that acting agent. Your job is to give your most intelligent analysis of that state: understand the goal, reason about the problem, and advise on what to do next. Surface the best approach, concrete next steps, likely pitfalls and risks, and anything the acting agent may have missed or gotten wrong.

Respond with your advice directly — no preamble, no disclaimers about tools or access. Your response is private guidance handed to the aggregator, not an answer shown to the user.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · prompts/general.md (reported line 5)May include surrounding context.

md

The conversation below is the current state of a task handled by that acting agent. Your job is to give your most intelligent analysis of that state: understand the goal, reason about the problem, and advise on what to do next. Surface the best approach, concrete next steps, likely pitfalls and risks, and anything the acting agent may have missed or gotten wrong.

Respond with your advice directly — no preamble, no disclaimers about tools or access. Your response is private guidance handed to the aggregator, not an answer shown to the user.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that conversation text is sent to multiple external reference models, but it does not provide a clear user-facing privacy warning about data disclosure, retention, or provider-specific handling. In this skill’s context, that omission is meaningful because the feature multiplies exposure of potentially sensitive prompts across several third-party providers, increasing confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill clearly instructs the agent to access environment variables, read local files, and invoke a Node executor that makes outbound calls, yet it declares no explicit tool scope or permissions. This creates an authorization/transparency gap where a user or host may not realize the skill needs sensitive capabilities, increasing the risk of unintended secret access and external data transmission.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Writing persistent mode state to ~/.openclaw/moa-mode-state creates cross-message/session behavioral persistence that can survive longer than the user expects. On its own this is not malicious, but it can silently change future data-handling behavior by causing automatic external transmission of later prompts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

• /moa code-review <question> → use code-review preset (task_type: coding)
• /moa arch-review <question> → use arch-review preset (task_type: architecture)
• /moa writing <question> → use writing preset (task_type: writing)
• /moa on → write on to ~/.openclaw/moa-mode-state and reply "MoA 持续模式已开启"
• /moa off → write off to ~/.openclaw/moa-mode-state and reply "MoA 持续模式已关闭"
• /moa doctor → run the executor in health mode:

  bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Persistent mode automatically routes every future user message through multiple external model providers, but the instructions only mention a mode toggle and footer rather than a clear, durable consent warning about ongoing external transmission. This can cause sensitive or unexpected data disclosure well beyond the original /moa invocation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Automatically processing every message in persistent mode raises the likelihood that sensitive information from unrelated conversations will be transmitted externally and then resurfaced in MoA-formatted outputs. The risk is amplified because the behavior applies across interactions rather than a single explicit request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and configuration sections list supported providers and presets but do not prominently warn that user prompts are sent to multiple third-party services in parallel. Missing privacy disclosure undermines informed consent and increases the chance users share confidential data without realizing where it goes.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions explicitly include verbatim reference outputs and the user's full original question in the response context, which can re-expose sensitive user content and third-party model outputs in plain text. This increases the chance of accidental disclosure to logs, downstream tools, screenshots, or subsequent prompt context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 138)May include surrounding context.

js

// =============================================================================

const API_ENDPOINTS = {
  openai: { url: "https://api.openai.com/v1/chat/completions", envKey: "OPENAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m = json.choices?.[0]?.message; return m?.content || m?.reasoning || ""; }, parseUsage: (json) => { const u = json.usage; if (!u) return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=
...[truncated 25 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 360)May include surrounding context.

js

// =============================================================================

const API_ENDPOINTS = {
  openai: { url: "https://api.openai.com/v1/chat/completions", envKey: "OPENAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m = json.choices?.[0]?.message; return m?.content || m?.reasoning || ""; }, parseUsage: (json) => { const u = json.usage; if (!u) return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=
...[truncated 25 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 139)May include surrounding context.

js

const API_ENDPOINTS = {
  openai: { url: "https://api.openai.com/v1/chat/completions", envKey: "OPENAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m = json.choices?.[0]?.message; return m?.content || m?.reasoning || ""; }, parseUsage: (json) => { const u = json.usage; if (!u) return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_t
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 361)May include surrounding context.

js

const API_ENDPOINTS = {
  openai: { url: "https://api.openai.com/v1/chat/completions", envKey: "OPENAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m = json.choices?.[0]?.message; return m?.content || m?.reasoning || ""; }, parseUsage: (json) => { const u = json.usage; if (!u) return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_t
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 141)May include surrounding context.

js

openai: { url: "https://api.openai.com/v1/chat/completions", envKey: "OPENAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m = json.choices?.[0]?.message; return m?.content || m?.reasoning || ""; }, parseUsage: (json) => { const u = json.usage; if (!u) return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 358)May include surrounding context.

js

openai: { url: "https://api.openai.com/v1/chat/completions", envKey: "OPENAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m = json.choices?.[0]?.message; return m?.content || m?.reasoning || ""; }, parseUsage: (json) => { const u = json.usage; if (!u) return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 142)May include surrounding context.

js

anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  deepseek: { url: "https://api.deepseek.com/v1/chat/completions", envKey: "DEEPSEEK_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0,
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 365)May include surrounding context.

js

anthropic: { url: "https://api.anthropic.com/v1/messages", envKey: "ANTHROPIC_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "anthropic-version": "2023-06-01" }, buildBody: (model, messages, maxTokens, temp) => ({ model, max_tokens: maxTokens||1024, temperature: temp??0.7, messages: messages.filter(m=>m.role!=="system"), system: messages.find(m=>m.role==="system")?.content }), parseResponse: (json) => json.content?.map(c=>c.text).join("") || "", parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.input_tokens||0, output_tokens: u.output_tokens||0, total_tokens: (u.input_tokens||0)+(u.output_tokens||0), cache_read_tokens: u.cache_read_input_tokens||0, reasoning_tokens:0 }; }, },
  openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  deepseek: { url: "https://api.deepseek.com/v1/chat/completions", envKey: "DEEPSEEK_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0,
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 143)May include surrounding context.

js

openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  deepseek: { url: "https://api.deepseek.com/v1/chat/completions", envKey: "DEEPSEEK_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  together: { url: "https://api.together.xyz/v1/chat/completions", envKey: "TOGETHER_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_de
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 363)May include surrounding context.

js

openrouter: { url: "https://openrouter.ai/api/v1/chat/completions", envKey: "OPENROUTER_API_KEY", apiKeyInHeader: true, defaultTimeout: 60000, headers: { "HTTP-Referer": "https://openclaw.ai", "X-Title": "OpenClaw MoA" }, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  deepseek: { url: "https://api.deepseek.com/v1/chat/completions", envKey: "DEEPSEEK_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  together: { url: "https://api.together.xyz/v1/chat/completions", envKey: "TOGETHER_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_de
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 145)May include surrounding context.

js

together: { url: "https://api.together.xyz/v1/chat/completions", envKey: "TOGETHER_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  xai: { url: "https://api.x.ai/v1/chat/completions", envKey: "XAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  google: { url: (model) => `https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent`, envKey: "GEMINI_API_KEY", apiKeyInHeader: false, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => { const contents = messages.filter(m=>m.role!=="system").map(m=>({role: m.role==="assistant"?"model":"user", parts:[{text:m.content}]})); const sm = messages.find(m=>m.role==="system"); const body={contents}; if(sm) body.system_instruction={parts:[{text:sm.content}]}; const gc={}; if(maxTokens) gc.maxOutputTokens=maxTokens; if(temp!==undefined) gc.temperature=temp; if(Object.keys(gc).length) body.generationConfig=gc; return body; }, pars
...[truncated 26 chars]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · moa-executor.js (reported line 366)May include surrounding context.

js

together: { url: "https://api.together.xyz/v1/chat/completions", envKey: "TOGETHER_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  xai: { url: "https://api.x.ai/v1/chat/completions", envKey: "XAI_API_KEY", apiKeyInHeader: true, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => ({ model, messages, max_tokens: maxTokens, temperature: temp }), parseResponse: (json) => { const m=json.choices?.[0]?.message; return m?.content||m?.reasoning||""; }, parseUsage: (json) => { const u=json.usage; if(!u)return null; return { input_tokens: u.prompt_tokens||0, output_tokens: u.completion_tokens||0, total_tokens: u.total_tokens||0, cache_read_tokens: u.prompt_tokens_details?.cached_tokens||0, reasoning_tokens: u.completion_tokens_details?.reasoning_tokens||0 }; }, },
  google: { url: (model) => `https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent`, envKey: "GEMINI_API_KEY", apiKeyInHeader: false, defaultTimeout: 30000, buildBody: (model, messages, maxTokens, temp) => { const contents = messages.filter(m=>m.role!=="system").map(m=>({role: m.role==="assistant"?"model":"user", parts:[{text:m.content}]})); const sm = messages.find(m=>m.role==="system"); const body={contents}; if(sm) body.system_instruction={parts:[{text:sm.content}]}; const gc={}; if(maxTokens) gc.maxOutputTokens=maxTokens; if(temp!==undefined) gc.temperature=temp; if(Object.keys(gc).length) body.generationConfig=gc; return body; }, pars
...[truncated 26 chars]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The executor sends the full conversation, only lightly truncated, to external model providers selected by preset. In this skill context, conversations may contain secrets, proprietary code, internal prompts, or personal data, so transmitting them to multiple third parties without an explicit consent and data-governance layer creates a real confidentiality risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The health-check path goes beyond simple MoA execution by enumerating which provider API keys are present and making outbound probes to many third-party endpoints. That expands the skill’s operational scope and can disclose environment configuration and trigger unintended network activity, which is risky in an agent setting where users may not expect a 'health' mode to touch external services broadly.

Content

No source excerpt is available for this finding.