Provider Probe

Probe and verify whether an OpenAI-compatible baseURL is a real single-model endpoint or a multi-model aggregation pool. Use when auditing model providers, c...

This skill is plausibly what it says (a probe for OpenAI-compatible endpoints) but it instructs the agent to read provider configuration files and to use API keys while not declaring any required config paths or credentials. Before installing or running: (1) inspect the bundled script locally (it is included) and run it yourself in a controlled environment rather than giving the agent broad permission to run it autonomously; (2) do not let the agent read system-wide config files you care about — pass only a minimal, sanitized config or explicit baseURL+apiKey for the provider you want tested; (3) be aware the script will send any API key you supply to whatever base_url you target (that is the intended behavior but is also how keys could be leaked); (4) prefer manual invocation or run inside an isolated container/VM and avoid giving the agent access to your main OpenClaw or cloud provider configs. If the publisher can clarify which config path(s) are needed and declare them (or require explicit user confirmation before reading any files), the inconsistency would be addressed.

Type: OpenClaw Skill Name: provider-probe Version: 1.0.0 The provider-probe skill is designed to audit LLM providers for authenticity, but it contains high-risk capabilities. The script scripts/provider_probe.py reads a local configuration file (/root/.openclaw/openclaw.json) containing sensitive API keys and transmits them to external endpoints specified in the config or via command-line arguments. While these actions are aligned with the stated purpose of probing providers, the script lacks input validation for the configuration file path and uses a hardcoded browser User-Agent to potentially bypass bot detection. No clear evidence of intentional malice or unauthorized data exfiltration was found, but the handling of secrets and arbitrary network access qualifies as suspicious under the provided criteria.