api-provider-setup
Warn
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
sync-agent-auth.shscript is vulnerable to command injection. It accepts a--providercommand-line argument and inserts it directly into a Python command string via shell interpolation without sanitization, which could allow for arbitrary code execution if the script is invoked with a maliciously crafted provider name. - [DATA_EXFILTRATION]: The skill and its script manage sensitive local configuration files, specifically
~/.openclaw/openclaw.jsonandauth-profiles.json. These files contain API keys for various AI providers. While the access is consistent with the skill's purpose of synchronizing credentials, it involves the programmatic handling and exposure of sensitive data stored in the local file system.
Audit Metadata