OpenClaw 集中配置管理系统

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.2.0

Overview

This looks like a real OpenClaw configuration skill, but it needs review because it asks users to run high-trust setup steps involving remote installers, credentials, external model routing, wallet funding, and persistent memory.

Review this skill before installing. Do not run the ClawRouter curl-to-bash command without independently inspecting and verifying it, pin Docker images where possible, use a dedicated low-balance wallet if funding is required, keep API keys and bot tokens out of Git and logs, set secret config files to 600, back up OpenClaw config and memory before restart, and only enable remote memorySearch or multi-provider routing for data you are comfortable sending to third parties.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The template mixes strong autonomy instructions ('Don't ask permission. Just do it.') with later guidance that anything leaving the machine should require approval. This ambiguity can cause downstream agents to prioritize the earlier unconditional directive and perform privacy-sensitive actions without explicit consent.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The guide expands a configuration-management skill into installing and operating an external routing service, including shell execution, gateway changes, and later API-key usage. That scope creep is dangerous because users may trust the skill as routine config guidance while it actually causes them to introduce new software and networked components with their own security risks.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Including wallet funding, USDC transfer, and withdrawal instructions is unrelated to centralized configuration management and pushes users into financial operations with an external service. In a trusted automation/config context, that can mislead operators into taking irreversible actions without appropriate fraud, custody, or compliance review.

Intent-Code Divergence

High

• Confidence: 93% confidence
• Finding: The FAQ claims data stays local, but the document also configures routed API-key-backed requests to external model providers. This contradiction can create a false sense of privacy and cause users to send sensitive prompts or data off-host under the mistaken belief that nothing leaves the environment.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The document shows bot tokens in a realistic secret format, which can normalize copying live-looking credentials into docs, chats, logs, or repositories. Even if the values are examples, presenting secrets this way increases the chance of accidental credential exposure and unsafe secret-handling practices.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template instructs the agent to automatically read user-related files such as USER.md, MEMORY.md, and daily memory logs at session start, without an explicit privacy notice, scope limitation, or consent boundary. In shared or misconfigured workspaces, this can normalize silent access to sensitive personal or project data beyond what the user intended for a given task.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The installation command pipes a remote script directly into bash, giving the remote endpoint immediate code execution on the user's system with no integrity verification or review. In a skill document, this is especially risky because users may copy-paste trusted setup commands without inspecting them.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The guide instructs users to place an API key into a config file but does not clearly warn that the key is a secret with billing and access implications. Even with chmod 600 later, users may expose the key through shell history, editors, backups, screenshots, or accidental commits.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document promotes intelligent routing, compression, and caching across a fallback chain of multiple model providers, but it does not clearly warn users that prompt contents and tool outputs may be sent to different third-party services depending on routing decisions. In a configuration skill for centralized agent infrastructure, that omission is meaningful because users may assume requests stay local except for a single provider, while the setup can materially change data-sharing and retention exposure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The installation instructions recommend piping a remote script directly into bash, which executes unreviewed code fetched over the network in a single step. If the hosting domain, TLS chain, update endpoint, or upstream script is compromised, users could run arbitrary code on their system immediately.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell users to create and save a new bot token but do not warn that the token is a high-value secret that must not be committed to files, shared in chat, or logged. This omission can lead to credential leakage, allowing attackers to hijack the bot identity and associated messaging workflows.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The JSON examples place Telegram bot tokens directly in configuration without any caution about secret exposure. Users may copy this pattern into plaintext config files that are backed up, logged, or checked into repositories, creating a straightforward path to credential compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document recommends configuring remote semantic search via a third-party API for memory content, but it does not clearly disclose that memory text or derived embeddings may be transmitted off-device to an external provider. Because the feature is specifically tied to a memory system that may contain sensitive operational or personal context, users could unknowingly expose confidential data.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Displaying live-format bot tokens in documentation can train users to treat secrets as ordinary strings and can result in real credentials being copied into insecure locations. If an actual token is ever exposed this way, an attacker could control the bot, read or send messages, and abuse connected automations.

External Transmission

Medium

• Category: Data Exfiltration

Content

tail -f ~/.clawrouter/logs/routing.log

# 测试请求
curl http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 78% confidence
• Finding: curl http://localhost:8080/v1/chat/completions \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. 安装 ClawRouter
curl -fsSL https://blockrun.ai/ClawRouter-update | bash

# 2. 重启 OpenClaw Gateway
openclaw gateway restart

• Confidence: 99% confidence
• Finding: curl -fsSL https://blockrun.ai/ClawRouter-update | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. 安装 ClawRouter
curl -fsSL https://blockrun.ai/ClawRouter-update | bash

# 2. 重启 OpenClaw Gateway
openclaw gateway restart

• Confidence: 97% confidence
• Finding: | bash

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.