higress-openclaw-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt asks the agent to collect users' API keys and shows/uses them verbatim in deployment and CLI commands (e.g., --zhipuai-key sk-xxx and ./get-ai-gateway.sh start ---key ), which requires the LLM to accept and emit secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The presence of an explicit install.sh download from an external domain (https://higress.ai/ai-gateway/install.sh) that the skill tells the user to fetch and execute is a high-risk distribution pattern (direct .sh execution from an unverified source); the localhost endpoints are local service URLs and not downloads themselves but do not mitigate the risk of running an untrusted installer.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The OpenClaw plugin (scripts/plugin/index.ts) automatically fetches model data from a user-specified Higress Console URL (fetchAvailableModels calling GET consoleUrl/v1/ai/routes) and uses the returned model list to populate defaults and configuration (including defaultModel/auto-routing), meaning arbitrary third-party console endpoints can supply untrusted content that directly influences agent/tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and executes a remote install script at runtime using "curl -fsSL https://higress.ai/ai-gateway/install.sh -o get-ai-gateway.sh" followed by running ./get-ai-gateway.sh, which fetches and runs remote code and therefore directly controls execution.