Security audit

ClawCache Free - LLM Cost Tracking & Caching

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent as an LLM cost-tracking cache, but it asks users to install ambiguous external Python packages and persist potentially sensitive LLM data with limited privacy guidance.

Review this before installing. Use an isolated virtual environment, verify the intended package name and publisher, pin an exact version, and avoid using it with secrets, regulated data, customer content, or private source code unless you have confirmed where prompts and responses are stored and how to disable, purge, or protect the cache.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:51
Finding: Unpinned and Inconsistently Named External Python Dependency
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` Install from a reviewed requirements file using: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Include the library source code in the audited repository, or provide a verifiable mapping between the package-index release, source commit, and signed release tag. 5. Prefer reviewed binary wheels and disable unnecessary source builds where practical: ```bash python -m pip install --only-binary=:all: --require-hashes -r requirements.txt ``` 6. Document the expected package publisher, official package-index URL, source repository, release signature, and artifact hashes. 7. Add automated checks that fail when documentation contains inconsistent package names or unpinned installation commands. 8. Install and run the dependency in a least-privileged virtual environment or container, without unrelated credentials or sensitive filesystem access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly advertises automatic logging of every LLM API call and automatic caching of responses, but it does not warn users that prompts and responses may contain sensitive data such as customer content, secrets, or regulated information. In a library intended for broad integration into production LLM workflows, this omission can lead developers to persist sensitive data locally by default without evaluating retention, access control, or redaction needs.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation encourages logging every LLM call and also promotes future social sharing and cloud sync features, which increases the risk that natural-language prompts, responses, usage history, or analytics derived from them could be exposed beyond the local environment. Even though the README does not show active exfiltration, normalizing comprehensive collection without privacy warnings or data-boundary guidance creates a realistic path to accidental disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill prominently advertises automatic logging of every LLM API call and local caching, but it does not clearly warn that prompts, responses, and related metadata may be persisted to disk. In many real deployments, prompts and model outputs contain secrets, customer data, source code, or regulated information, so silent persistence materially increases the risk of sensitive data exposure through local files, backups, or multi-user systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The environment-variable configuration describes changing the cache directory but does not explain that cached responses and logs will be written there. This omission can cause users to redirect sensitive LLM artifacts into insecure, shared, synced, or backed-up locations without understanding the privacy implications.
Content: No source excerpt is available for this finding.