ClawHub
Back to skill

Security audit

claude-usage-companion

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for usage monitoring, but its default scheduled setup repeatedly runs a mutable npm package and includes cron/shell-command risks that merit review before installation.

Review before installing. Prefer a pinned or locally installed ccusage binary instead of npx -y ccusage@latest, inspect generated cron lines before adding them, avoid piping install --cron-only directly to crontab, keep config.json writable only by your account, and only set alert_command to a command you fully trust.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
config.example.json:11
Finding

Scheduled execution of an unpinned third-party npm package

Content
View full analysis
Remediation
View remediation
``` 3. Commit a lockfile containing dependency versions and integrity hashes, and install with a deterministic command such as: ```bash npm ci ``` 4. Ensure scheduled jobs execute the pinned local binary, for example through `node_modules/.bin/ccusage`, rather than invoking `npx`. 5. Remove `-y` from any remaining interactive `npx` workflows so unexpected package installation requires explicit approval. 6. Run the scheduled process under a dedicated, unprivileged account with access only to the usage data and output files it needs. 7. Add dependency review and update controls so version changes are tested and audited before deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
bin/usage-companion.mjs:228
Finding

Unvalidated configuration permits cron-entry injection

Content
View full analysis
> ${LOG_PATH} 2>&1`; const lines = [ `CRON_TZ=${cfg.timezone}`, `# monitor the programmatic credit pool 3x/day`, `0 9,14,19 * * * node ${self} guard ${log}`, `# remind you to start your interactive session at your anchor time`, `${am} ${ah} * * * node ${self} remind ${log}`, ]; console.log("# claude-usage-companion — paste into `crontab -e`"); console.log("# (CRON_TZ pins these to YOUR timezone regardless of the server's.)"); lines.forEach(l => console.log(l)); console.log(""); console.log("# one-liner to append (review first):"); console.log(`# ( crontab -l 2>/dev/null; node ${self} install --cron-only ) | crontab -`); } function cmdInstallCronOnly(cfg) { const self = join(ROOT, "bin", "usage-companion.mjs"); const [ah, am] = cfg.anchor.split(":").map(Number); const log = `>> ${LOG_PATH} 2>&1`; console.log(`CRON_TZ=${cfg.timezone}`); console.log(`0 9,14,19 * * * node ${self} guard ${log}`); console.log(`${am} ${ah} * * * node ${self} remind ${log}`); } ``` ### Technical Analysis Values loaded from `config.json` are inserted directly into generated crontab content. In particular, `cfg.timezone` is emitted after `CRON_TZ=` without validation or rejection of newline characters. An attacker-controlled value can therefore terminate the environment assignment and add one or more arbitrary cron entries. The `anchor` field is also parsed without validating its format or range. Although conversion through `Number` limits direct text injection through that field, malformed values can generate invalid schedules such as `NaN NaN`, creating a denial of service for the reminder ...[truncated 2410 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
node bin/usage-companion.mjs check # verifies node + ccusage + reads your usage

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
node bin/usage-companion.mjs check # verifies node + ccusage + reads your usage

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
node bin/usage-companion.mjs check # verifies node + ccusage + reads your usage

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
node bin/usage-companion.mjs check # verifies node + ccusage + reads your usage

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest and README emphasize that the skill only reports usage and emits reminders, never automating Claude itself or performing broader side effects. However, the documented install [--cron-only] behavior explicitly supports piping output to crontab -, giving the skill a system-configuration capability that is not necessary to merely report or remind and goes beyond the narrowly stated purpose.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

3. Schedule it.

bash
node bin/usage-companion.mjs install   # prints a ready-to-paste cron block
crontab -e                             # paste it, save

Now the box checks your credit pool a few times a day (alerting only when you cross a threshold) and reminds you at your anchor time to start your interactive session.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

3. Schedule it.

bash
node bin/usage-companion.mjs install   # prints a ready-to-paste cron block
crontab -e                             # paste it, save

Now the box checks your credit pool a few times a day (alerting only when you cross a threshold) and reminds you at your anchor time to start your interactive session.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · bin/usage-companion.mjs (reported line 239)May include surrounding context.

js
**3. Schedule it.**
```bash
node bin/usage-companion.mjs install   # prints a ready-to-paste cron block
crontab -e                             # paste it, save
```
Now the box checks your credit pool a few times a day (alerting only when you cross a threshold)
and reminds you at your anchor time to start your interactive session.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/index.html (reported line 153)May include surrounding context.

html
**3. Schedule it.**
```bash
node bin/usage-companion.mjs install   # prints a ready-to-paste cron block
crontab -e                             # paste it, save
```
Now the box checks your credit pool a few times a day (alerting only when you cross a threshold)
and reminds you at your anchor time to start your interactive session.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

deliver() executes cfg.alert_command with spawnSync(..., { shell: true, input: message }), so any value placed in configuration is run by the shell with the privileges of the current user. In this skill's context, the command is intended for notifications, but if an attacker can modify config.json or influence provisioning of the skill, this becomes arbitrary command execution and can be triggered automatically by cron.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · bin/usage-companion.mjs (reported line 244)May include surrounding context.

js
lines.forEach(l => console.log(l));
  console.log("");
  console.log("# one-liner to append (review first):");
  console.log(`#   ( crontab -l 2>/dev/null; node ${self} install --cron-only ) | crontab -`);
}
function cmdInstallCronOnly(cfg) {
  const self = join(ROOT, "bin", "usage-companion.mjs");

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This is a manifest/config JSON file, so vague-trigger checks apply. The reminder text instructs the user to "Open Claude Code / Cowork and send one now," but does not specify any precise command, trigger phrase, or constraints, making the invocation guidance broad and potentially overlapping with ordinary user behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
bin/usage-companion.mjs:78