OC Cost Analyzer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 1.0.1

Overview

This local cost-reporting skill is purpose-aligned, but it needs review because its documented data-access path does not match the script and it includes a broad memory-file deletion command.

Review this skill carefully before installing. It appears to run locally without network access, but it reads OpenClaw conversation logs from a sensitive memory path that is not accurately documented. Avoid running the documented cleanup command unless you first list the files it would match and have backups, because it can delete persistent memory Markdown files. Use the cron examples only if you intentionally want recurring cost checks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:180

Finding

Destructive cleanup guidance can delete persistent memory files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:180
Vulnerability Type: Destructive File Deletion
Risk Level: Medium

Vulnerable Code

bash

find ~/.openclaw/workspace/memory -name "2026-*.md" -mtime +30 -delete

Technical Analysis

The Skill recommends recursively deleting every Markdown file under ~/.openclaw/workspace/memory whose name matches 2026-*.md and whose modification time exceeds 30 days. The command does not verify that matched files are disposable logs, does not provide a dry run, does not request confirmation, and does not create a backup.

The target directory may contain persistent Agent memory, generated reports, or unrelated Markdown records. The filename pattern is insufficient to distinguish temporary logs from valuable state. This destructive operation is also inconsistent with the Skill's claims that it performs read-only analysis and does not modify other files.

Although the analyzer script does not automatically execute this command, a user or Agent following the Skill's documented optimization procedure could run it directly.

Attack Path

1. A user or Agent loads the Skill and follows its context-optimization guidance.
2. The documented find command is executed in the user's environment.
3. find recursively searches the complete OpenClaw memory directory.
4. Every file matching 2026-*.md and older than 30 days is deleted without confirmation.
5. Persistent memory or unrelated records matching those conditions are irreversibly lost unless an external backup exists.

Impact Assessment

The command runs with the invoking user's filesystem privileges. It can delete any matching file beneath the user's OpenClaw memory directory, including long-term Agent state and unrelated Markdown records. It does not provide broader privilege escalation, network access, or deletion outside the specified directory, but the resulting loss of persistent state may affect future Agent sessions and stored operat ...[truncated 14 chars]

Remediation

View remediation

Remediation Suggestions

Remove the destructive command from the Skill documentation. If cleanup functionality is required:

1. Restrict it to a dedicated, documented disposable-log directory.
2. Identify files using validated metadata rather than a broad filename pattern.
3. Display candidates first with a non-destructive command:

   bash

   find ~/.openclaw/workspace/memory/conversations \
     -type f -name "*.jsonl" -mtime +30 -print
   

4. Require explicit user confirmation before deletion.
5. Exclude persistent memory and report files by construction.
6. Recommend creating a backup or moving candidates to a quarantine directory before permanent deletion.
7. Update the read-only security claims if destructive maintenance remains part of the documented workflow.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/cost_analyzer.js:14

Finding

Actual session-log access scope conflicts with the documented security boundary

Content

View full analysis

Vulnerability Details

File Location: scripts/cost_analyzer.js:14
Vulnerability Type: Undisclosed Local Data Access
Risk Level: Low

Vulnerable Code

javascript

const CONFIG = {
  logsDir: path.join(os.homedir(), '.openclaw/workspace/memory/conversations'),
  memoryDir: path.join(os.homedir(), '.openclaw/workspace/memory'),
  outputDir: path.join(os.homedir(), '.openclaw/workspace/memory'),

The security documentation instead declares a different read location:

markdown

**Read access**:
- `~/.openclaw/agents/main/agent/sessions/*.jsonl` (session logs)

Technical Analysis

The executable reads JSONL files from ~/.openclaw/workspace/memory/conversations, while SECURITY.md and SKILL.md repeatedly state that session logs are read from ~/.openclaw/agents/main/agent/sessions/*.jsonl.

This mismatch makes the declared local-data access boundary inaccurate. Users reviewing the security policy cannot reliably determine which potentially sensitive conversation records will be processed. The script traverses year-month subdirectories and parses every recent .jsonl file found there.

No evidence indicates that the parsed content is transmitted externally: the implementation contains no network request, subprocess, telemetry, or dynamic-code mechanism. The issue is therefore limited to undisclosed local read scope and misleading permission documentation rather than data exfiltration.

Attack Path

1. A user reviews the security policy and expects access only to ~/.openclaw/agents/main/agent/sessions.
2. The user runs the analyzer based on that declared boundary.
3. The script instead opens ~/.openclaw/workspace/memory/conversations.
4. It traverses matching month directories and reads recent JSONL conversation files.
5. Derived session identifiers, models, token counts, and costs are written to the local report and printed to the console.

Impact Assessment

The script operates with the invoking user's existing fi ...[truncated 594 chars]

Remediation

View remediation

Remediation Suggestions

Align the implementation and documentation around one explicit data source:

1. Change CONFIG.logsDir to the documented sessions directory, or update every security and usage document to disclose the actual conversation-memory path.
2. Prefer a user-supplied command-line path rather than an implicit sensitive-data location.
3. Resolve and validate the selected path against an allowlisted base directory before reading files.
4. Clearly document the types of records parsed and metadata emitted in reports.
5. Fail closed when the requested path is outside the declared boundary.
6. Add automated tests that compare documented default paths with runtime configuration.
7. Remove the unused memoryDir setting or document its purpose to keep the declared access model precise.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (12)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SECURITY.md (reported line 92)May include surrounding context.

md

## Comparison with Similar Tools

Unlike some optimization tools that may:
- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation is written entirely in Chinese, including its purpose, usage, and safety notes, with no indication that other languages are supported or that Chinese is a justified region-specific requirement. This can violate a language/locale policy when users are not given an opt-in or alternative.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 28)May include surrounding context.

md

**Read access**:
- `~/.openclaw/agents/main/agent/sessions/*.jsonl` (session logs)

**Write access**:
- `~/.openclaw/workspace/memory/cost-analysis-report.md` (report output)

No other files are accessed or modified.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 92)May include surrounding context.

md

## Comparison with Similar Tools

Unlike some optimization tools that may:
- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 94)May include surrounding context.

md

Unlike some optimization tools that may:
- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

openclaw-cost-optimizer:

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SECURITY.md (reported line 95)May include surrounding context.

md

- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

openclaw-cost-optimizer:
- ✅ Runs entirely offline

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s natural-language instructions, examples, and operational guidance are all presented in Chinese, and there is no indication that users can choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads conversation logs from the user’s home-directory OpenClaw workspace, which may contain sensitive prompts, outputs, and metadata, without any explicit warning, consent prompt, or scope confirmation. In a skill context, silent access to historical conversation data creates a privacy risk because users may not realize the tool inspects private session content rather than only aggregate counters.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script emits report headings and timestamps in Chinese, including an explicit zh-CN locale for formatting, regardless of user preference. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file contains user-facing natural language in multiple languages, with most feature descriptions written in Chinese and some headings/terms in English. Under the stated policy, forcing a language or locale without offering a choice can be a natural-language policy concern, and no opt-in or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The package description is written only in Chinese and states the skill's purpose in that language, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill implicitly requires a specific language without offering opt-in or alternatives.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest emphasizes analysis and clear reporting, which suggests a read/compute/reporting tool over local logs. In addition to analyzing logs, the code performs a filesystem write by saving the generated report to ~/.openclaw/workspace/memory/cost-analysis-report.md, which is a side effect not stated in the description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.