Security audit

TurboQuant Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real local token-optimization skill, but it has broad access to conversation context and one avoidable local-file boundary issue that users should review before installing.

Install only if you are comfortable with a skill that can inspect and rewrite conversation context before model calls. Avoid automatic mode for secrets, regulated data, legal/medical/security work, or workflows where exact prompt and tool-output fidelity matters. Prefer explicit session files over defaults, and the publisher should validate --session paths and document privacy, caching, checkpointing, and disable controls more clearly.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The analyze command implicitly reads the latest local OpenClaw session from the user's home directory when no file is provided. Session transcripts can contain sensitive prompts, secrets, or personal data, and the CLI does not clearly disclose this default data access before processing it.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The optimize command builds a path with path.join(sessionsDir, `${sessionId}.jsonl`) using unsanitized user input. An attacker can supply traversal components like ../../ to escape the sessions directory and cause the CLI to read arbitrary local files with a .jsonl suffix, violating expected file access boundaries.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README claims that 'all API calls automatically optimized' and 'no code changes needed' without disclosing that prompts, conversation history, or other context may be transformed before transmission. In an LLM/OpenClaw skill, silent interception and mutation of user or agent context can affect confidentiality, integrity, and user expectations, especially if sensitive data is compressed, deduplicated, or altered in ways the operator does not understand.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill claims it works automatically and monitors all API calls, but the documentation provides no disclosure about what data is observed, whether prompts/tool outputs are retained, or how sensitive content is handled. In a conversation optimization skill, transparent interception of all requests can expose private prompts, credentials, proprietary code, or personal data to logging, caching, or secondary processing without informed user consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Conversation checkpointing and rollback imply storage and possible branching of conversation state, but the skill documentation does not warn users that historical prompts and outputs may persist beyond the active session. This increases the risk of sensitive information being retained, restored unexpectedly, or exposed through local storage, backups, reports, or shared environments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code silently reads local session transcripts from ~/.openclaw/agents/main/sessions when the user omits a file argument. Even if intended for optimization, undisclosed access to conversation history is privacy-sensitive because those transcripts may contain confidential user or system data.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The optimize command automatically loads either a specified session or the latest local transcript without a clear privacy warning. Because optimization operates on conversation content, this can process sensitive local data in ways users may not expect from a generic CLI command.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The visualize command reads the latest local session transcript by default to estimate token usage, again without explicit notice. Although it only displays aggregate token information, it still accesses potentially sensitive transcript content from disk, creating a privacy issue through undisclosed collection.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The training document states that the skill 'automatically optimizes all API calls' but does not disclose that conversations may be altered, cached, compressed, or checkpointed. In a system handling user prompts, tool outputs, and potentially sensitive data, silent transformation or persistence creates a real privacy and transparency risk because operators may deploy it without informed consent or retention controls.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documented configuration enables checkpointing and tool-result compression/caching features without warning that these mechanisms may store conversation content or tool outputs beyond immediate processing. This can expose sensitive prompts, credentials, file contents, or external tool data to unintended retention, reuse, or later disclosure, especially in shared or regulated deployments.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: Checkpointing derives and stores a hash over the full serialized conversation, along with retention metadata, without any consent, disclosure, or configurable data-minimization policy. Even though only a hash is stored in the checkpoint object, it is still persistent conversation-derived state and can enable correlation, fingerprinting, and retention of sensitive session artifacts beyond user expectations, especially in multi-tenant or privacy-sensitive deployments.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Tool outputs are cached in process memory and later reused based solely on content hash, without any user disclosure, session scoping, or sensitivity classification. If tool results contain secrets, personal data, or tenant-specific outputs, this design can retain and replay sensitive information longer than necessary and may enable cross-request or cross-user data exposure in shared runtimes.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The presentation explicitly advertises an automatic, zero-config mode that optimizes all API calls, but it does not disclose that conversation history may be compressed, transformed, deduplicated, or cached in ways that can alter fidelity. In a context-management skill, this omission is security-relevant because users may unknowingly enable lossy handling of prompts, tool outputs, or prior instructions, which can lead to incorrect model behavior, hidden context loss, or unsafe downstream decisions.

Static analysis

No suspicious patterns detected.