Token Optimizer for OpenClaw & Hermes

• Outcome: Pass
• Latest audit: Sep 19, 2026 · 4:31 PM UTC
• Version: 4.1.1

Overview

This skill appears to be a disclosed, read-only token and cost auditing helper rather than something that changes settings or collects credentials.

Install only if you are comfortable letting the agent run local read-only OpenClaw diagnostics and read explicitly selected config/profile files. Review generated reports before sharing them, because model names, agent IDs, filenames, and findings can still reveal private operational details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for a passive auditing skill focused on identifying token waste and suggesting safe next steps. The supplied code does not implement analysis logic, inspection, reporting, or cost-review behavior. Instead, it is a thin command-line shim that prepends the argument 'route' and dispatches into optimizer.main(), which indicates an operational routing function. That is a materially different primary purpose from the declared auditing role, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose emphasizes a diagnostic, explanatory skill for reviewing token waste and recommending safe next steps without making changes. The supplied code does not implement such analysis directly; instead, it modifies argv to inject the subcommand 'budget' and then hands control to optimizer.main(). That indicates the code's real role is a command wrapper or migration shim into an optimizer/budget flow. Because this could execute optimization or budget-related behavior outside the narrowly declared read-only auditing purpose, the description does not accurately represent the code chunk's primary behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 52)May include surrounding context.

md

"""Hermes file-only adapter. No Hermes imports, subprocesses, .env reads or writes."""
import json
from pathlib import Path
from optimizer_core import VERSION, finding, safe_id

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/HERMES.md (reported line 14)May include surrounding context.

md

"""Hermes file-only adapter. No Hermes imports, subprocesses, .env reads or writes."""
import json
from pathlib import Path
from optimizer_core import VERSION, finding, safe_id

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/hermes_adapter.py (reported line 1)May include surrounding context.

python

"""Hermes file-only adapter. No Hermes imports, subprocesses, .env reads or writes."""
import json
from pathlib import Path
from optimizer_core import VERSION, finding, safe_id

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly instructs the agent to use Python and run read-only audits, but it declares no tool restrictions such as allowed-tools or permissions. That creates an unnecessary capability gap: a host may permit broader shell or file access than intended, and the skill relies only on natural-language boundaries like 'read-only' and 'never print raw configuration,' which are not enforcement mechanisms.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/QUICKSTART.md (reported line 49)May include surrounding context.

md

## Ambiguity examples

- Host says OpenClaw, current agent ID known: audit that agent without asking runtime again.
- Host says Hermes, active profile known: audit that profile; no exports questionnaire.
- Both CLIs installed, no active-host evidence: ask which runtime/profile to inspect.
- Hermes profile known, cron file absent: inspect config only and mark jobs not checked.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The docstring states that 'explicit v4 arguments' are required, which implies callers must provide the needed arguments themselves. However, the wrapper inserts 'route' into sys.argv automatically before invoking main(), preserving implicit behavior rather than requiring fully explicit invocation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/optimizer.py (reported line 28)May include surrounding context.

python

def native(args, json_output=True):
    # No shell, no arbitrary executable/command option, no auth probe or mutation.
    result = subprocess.run(['openclaw', *args], capture_output=True, text=True, timeout=45, check=False)
    if result.returncode:
        raise ValueError('Native read command failed; inspect OpenClaw locally. Raw output withheld to protect secrets.')
    if len(result.stdout) > MAX_BYTES:

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/optimizer_core.py (reported line 154)May include surrounding context.

python

seen[normalized] = name
        results.append(item)
    return {'version': VERSION, 'files': sorted(results, key=lambda x: -x['characters']),
            'note': 'Character/4 heuristic, not measured prompt tokens. Native /context detail is authoritative; no truncation or edits performed.'}

def budget(usage=None, limit=None):
    if usage is None:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script contradicts its own documented behavior by silently inserting the 'budget' subcommand into sys.argv before calling main(). This can bypass caller expectations, hide actual invocation semantics, and cause automation or security wrappers to execute a mode the user did not explicitly request, which is dangerous in tooling that may be chained into larger agent workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.