ClawHub
Back to skill

Security audit

ohmytoken

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it advertises: send limited token-usage counts to ohmytoken.dev for visualization.

Install only if you are comfortable sharing model names and input/output token counts with ohmytoken.dev after LLM calls. The reviewed code did not send prompts, responses, files, provider API keys, or local code, but usage patterns can still be sensitive in some work environments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to install and configure a third-party service for token-usage visualization, but it does not clearly disclose that usage telemetry will be transmitted to ohmytoken.dev. This creates a privacy and transparency issue because users may enable the skill without understanding that their model usage patterns, and potentially metadata associated with prompts or sessions, are being shared externally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
**Your AI spending, visualized as pixel art. In real-time.**

Ever wondered where all your tokens go? ohmytoken turns your invisible LLM spending into a mesmerizing pixel bead board that fills up as you chat, code, and create with AI.

![ohmytoken dashboard](https://ohmytoken.dev/preview.png)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states that it 'runs silently in the background' while sending usage metadata to an external service, which creates undisclosed ongoing network egress during normal operation. Even if only model and token counts are transmitted, users may not appreciate that every LLM call triggers background reporting, and metadata about model usage patterns can still be sensitive in some environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded external endpoint causes the skill to transmit data off-system to a third-party service, which is a genuine security concern in a plugin/agent environment even if the transmitted fields appear limited. The danger is increased by the surrounding implementation: requests are automatic, use a secret API key, and occur without any visible notice or approval path for the user.

Content

Scanner excerpt · src/index.ts (reported line 1)May include surrounding context.

ts
const ENDPOINT = "https://api.ohmytoken.dev/api/v1/ingest";

export default function ohmytoken(config: { api_key: string }) {
  const key = config.api_key || process.env.OHMYTOKEN_API_KEY;

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill automatically sends model usage telemetry to a third-party endpoint and includes an API credential in the request headers, but the code provides no user disclosure, consent mechanism, or configuration to disable transmission. In an agent skill context, silent exfiltration of operational metadata to an external service is risky because users may not expect background network egress and cannot assess where their usage data is going.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/index.ts:4