OpenClaw Cost Analyzer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 1.0.0

Overview

This skill locally analyzes OpenClaw usage logs and writes a local cost report, with no evidence of network transfer, hidden execution, or automatic system changes.

Before installing, confirm you are comfortable letting the skill read local OpenClaw conversation/session logs and write a cost report under the OpenClaw memory directory. Treat the cron, model-switching, and cleanup examples as manual commands to review before running, especially because recurring cron jobs persist until removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Exfiltration Commands

High

• Category: Prompt Injection

Content

## Comparison with Similar Tools

Unlike some optimization tools that may:
- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill description is written entirely in Chinese and explicitly states it is designed for OpenClaw users, but it does not offer any language choice or explain a region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Read access**:
- `~/.openclaw/agents/main/agent/sessions/*.jsonl` (session logs)

**Write access**:
- `~/.openclaw/workspace/memory/cost-analysis-report.md` (report output)

No other files are accessed or modified.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Comparison with Similar Tools

Unlike some optimization tools that may:
- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Unlike some optimization tools that may:
- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

openclaw-cost-optimizer:

• Confidence: 60% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

- ❌ Send data to external APIs
- ❌ Require API keys
- ❌ Modify system configurations
- ❌ Execute arbitrary code

openclaw-cost-optimizer:
- ✅ Runs entirely offline

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file uses Chinese throughout the description and instructions, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. That creates a natural-language locale policy concern because the skill effectively forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated report timestamp uses toLocaleString('zh-CN', { timeZone: 'Australia/Melbourne' }), which forces a specific language/locale and regional setting in output. This is a natural-language policy issue because the skill does not offer user opt-in or explain why this locale/time zone is required.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This file contains substantial user-facing natural language in Chinese alongside English feature labels, but it does not indicate that the skill is intentionally region-specific or offer any language/locale choice. Under the policy rule for natural-language constraints, forcing or assuming a language without opt-in can be a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The package description is written entirely in Chinese and provides no indication that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale constraint that is not documented as optional or justified.

Static analysis

No suspicious patterns detected.