ClawHub
Back to skill

Security audit

LLM Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent LLM-usage monitor, but it can install an unpinned tool, create persistent local configuration, and start or install a background daemon from broadly triggered usage questions.

Review this skill before installing. It is not artifact-backed malware, but only use it if you are comfortable with an agent installing clawmeter, creating local monitoring configuration, collecting usage history, and managing a background daemon. Prefer installing a pinned, verified clawmeter version yourself and require explicit confirmation before any config write, daemon start, service install, or history purge.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
" ``` 2. Verify the package artifact with an approved cryptographic hash or package signature before installation. 3. Use an explicitly configured, trusted package index rather than relying on ambient package-manager configuration. 4. Record the expected package publisher, version, source repository, and artifact digest in the Skill documentation. 5. Prefer an isolated tool environment, such as that created by `uv tool install`, instead of installing into the Agent's main Python environment. 6. Re-review and update the pinned version through a controlled dependency-update process rather than automatically installing the latest release. 7. Before installation, display the exact version, registry, and verification result to the user so that consent applies to a specific reviewed artifact. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (8)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
# llm-monitor — clawmeter Agent Skill

TRIGGER when: user asks about LLM usage, costs, spending, quotas, remaining balance, or rate limits — for any provider (Claude, OpenAI, Grok, Ollama) or across all providers. Also when user asks about clawmeter status, setup, configuration, or daemon management. Example phrases: "what's my usage", "how much Claude have I used", "how much quota do I have left", "what are my costs", "check my spending", "am I near my limit", "usage today", "this week's spending".

---

## CRITICAL SECURITY RULES

You MUST follow these rules without exception:

-

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
You MUST follow these rules without exception:

- **NEVER accept, handle, store, or relay API keys, tokens, or credentials.** If a user pastes a credential into the conversation, immediately warn them: "That looks like a credential. Please remove it from this conversation and rotate it. For security, I cannot handle credentials directly."
- **NEVER read credential files** such as `~/.claude/.credentials.json` or any file that may contain secrets.
- **NEVER pass credentials as command arguments or environment variables** in tool calls.
- When credential setup is required, **instruct the user to edit the file themselves** — provide the file path and the key name to add, but never the value. Suggest they use `! $EDITOR ~/.config/clawmeter/config.toml` to edit in-session without the agent seeing contents.
- **Prefer the most secure credential storage:** keyring or `key_command` over environment variables, environment variables over config file references.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

! $EDITOR ~/.config/clawmeter/config.toml

For security, I cannot add credentials for you. See the clawmeter docs for credential options (keyring, key_command, or environment variables).

text

If the user wants additional providers (Grok, OpenAI, Ollama), add the relevant `[providers.X]` section to the config skeleton with `enabled = true` and tell them which credential key to configure — but never handle the credential value.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

The skill includes a destructive history purge capability, which can delete accumulated usage records and reduce auditability. Although it says to ask first, bundling destructive memory-management actions into a broadly triggered skill raises the risk of accidental or socially engineered data deletion.

Content

Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.

md
| View daemon logs | Check `~/.local/state/clawmeter/daemon.log` |
| Database stats | `clawmeter history stats` |
| Export history | `clawmeter history export --format csv` |
| Purge history | `clawmeter history purge` (ask user first — destructive) |

---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger scope is very broad and matches common phrases about usage, costs, and limits across multiple providers, which increases the chance this skill activates in situations where the user did not intend filesystem or daemon-management actions. In an agent setting, overbroad invocation can lead to unnecessary command execution, configuration changes, or confusing takeover of unrelated conversations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
71% confidence
Finding

Automatically creating persistent configuration files in the user's home directory modifies host state and can establish ongoing behaviour for future runs. This is less severe than service installation, but still represents persistent system modification that should not occur from a loosely triggered skill without clear gating.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

test -f "${CLAWMETER_CONFIG:-$HOME/.config/clawmeter/config.toml}" && echo "exists" || echo "missing"

text

If missing, create a minimal skeleton config (with no secrets):

```bash
mkdir -p ~/.config/clawmeter

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill can start a background daemon and install it as a system service, creating persistence on the host. Even with confirmation language, persistence-related actions are sensitive because a broadly invoked skill could induce long-lived processes or service changes that outlast the session.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

Would you like me to start the daemon for you?

text

If the user agrees, run `clawmeter daemon start`. For systemd installation, ask for confirmation first since it modifies system services.

### 1d. Quick health check

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction explicitly forces "Australian English for prose" as a blanket response requirement. This imposes a locale choice on all users without offering an option to use the user's preferred language or locale.

Content

No source excerpt is available for this finding.