Openclaw Tokenapi Qiehuan Skills

提供基于WebUI的快速AI模型切换工具，支持保存配置、一键切换、批量导入及API Key本地存储管理。

This package mostly does what a local model-switcher would do, but there are important mismatches and sensitive behaviors you should check before installing: - Do not assume API keys stay only in the browser: the backend endpoints accept API keys and call secure storage/update routines. Inspect backend/secure_config.py to confirm whether API keys are encrypted at rest and how keys are written to ~/.openclaw/agents/.../auth-profiles.json. - Review any restart scripts referenced (tools/restart_gateway.bat, gateway.cmd under ~/.openclaw). Those are executed by the service (subprocess calls and taskkill) and could run arbitrary commands if modified or replaced on disk. - Confirm the server only binds to localhost in your deployment. If it binds to 0.0.0.0 or you run behind a proxy, CORS allow_origins=['*'] may expose endpoints that accept API keys to other hosts. - If you will store real production API keys, test in an isolated environment first (VM/container) to verify where keys end up and whether they are protected. - If you want to proceed, at minimum: (1) inspect secure_config.py to verify encryption, (2) restrict CORS or bind to 127.0.0.1 only, (3) review or replace restart scripts with safe versions, and (4) consider running with least privilege and backups of ~/.openclaw before first run. Because of the documentation/code disagreement about API key handling and the ability to run system commands and write to sensitive config locations, treat this skill as suspicious until you verify those details.

Type: OpenClaw Skill Name: openclaw-tokenapi-qiehuan-skills Version: 0.1.0 The skill bundle functions as a management utility for OpenClaw but includes capabilities that significantly weaken the agent's security posture. Specifically, the 'Advanced Settings' feature allows for the programmatic disabling of the sandbox mode, shell execution restrictions, and execution security prompts (found in `backend/app/api/schemas.py` and `backend/app/core/config_manager.py`). Furthermore, the backend utilizes risky `subprocess` calls with `shell=True` to terminate processes and execute local scripts (`backend/app/core/gateway.py`), which could be leveraged for command injection if the agent is influenced by malicious prompts. While no evidence of intentional data exfiltration was found, the ability to toggle core security defenses makes this bundle highly sensitive.