T02 · Agent Memory Poisoning
Warning
- Location
lib/cost-tracker.js:87- Finding
Persistent Agent-Readable Log Injection Through Unsanitized Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Cost Governor - Subagent Budget Control
Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it overstates its ability to enforce budget controls and keeps persistent cost logs that need careful review.
Review this skill before installing if you expect hard billing protection. Treat it as an advisory estimator/logger unless you add an enforced wrapper around subagent spawning, avoid storing sensitive task details in cost-tracking.md, and do not rely on the documented .env budget cap to stop spending.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:93- Finding
Documented Budget Cap Is Written to a Sensitive Configuration File but Never Enforced
- Content
View full analysis
> ~/.openclaw/workspace/.env ``` It subsequently claims that the budget is enforced: ```markdown ## Budget Alerts Set a daily budget cap. When spend exceeds it, the agent stops spawning and notifies you. ``` `README.md` makes a similar enforcement claim: ```markdown Add to workspace `.env`: ```bash DAILY_BUDGET=50.00 WEEKLY_BUDGET=300.00 ``` Agent will warn when approaching limits. ``` However, neither `lib/cost-tracker.js` nor `bin/cost-summary.js` reads `DAILY_BUDGET` or `WEEKLY_BUDGET`. The implementation does not calculate budget consumption, warn when a threshold is approached, or block a spawn when a budget is exceeded. ### Technical Analysis The setup command appends data to `~/.openclaw/workspace/.env`, a configuration file that may also contain API keys or other secrets. The command does not read or disclose existing credentials, but modification of this file is unnecessary for the current executable implementation because the budget value is never consumed. Using `>>` is also non-idempotent. Repeated setup adds duplicate definitions, leaving behavior dependent on how another environment loader resolves duplicate keys. The more significant issue is a fail-open control: users are told that a configured daily budget will stop spawning, while no executable enforcement exists. The Skill therefore presents an advisory configuration value as an active spending safeguard. ### Attack Path 1. A user follows the installation documentation and appends `DAILY_BUDGET` to the workspace `.env` file. 2. The user relies on the stated behavior that spending above the conf ...[truncated 1182 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/cost-tracker.js:52- Finding
Approval Gate Is Advisory and Can Be Explicitly Bypassed
- Content
View full analysis
APPROVAL_THRESHOLD; } ``` The setup guide documents a direct bypass: ```markdown **Need to bypass gate?** - Say "proceed without cost check" (still logs) - Or reduce approval threshold in SKILL.md (not recommended) ``` ### Technical Analysis `checkApprovalRequired()` is a policy helper, not an enforcement boundary. It has no binding to the actual `sessions_spawn` operation, does not require an approval artifact, and does not reject execution when approval is absent. The project documentation describes approval for estimates above `$0.50` as a core rule, but also instructs users that the check can be bypassed with a phrase. No distinction is made between an authorized administrative override and an ordinary request. Because the enforcement depends entirely on the calling agent voluntarily invoking and honoring the helper, omitted integration, prompt manipulation, caller error, or the documented bypass can cause the control to fail open. ### Attack Path 1. A user or untrusted prompt requests an expensive subagent spawn. 2. The caller omits `checkApprovalRequired()`, ignores its return value, or follows the documented “proceed without cost check” bypass. 3. No code-level mechanism requires a matching explicit approval. 4. The underlying spawn operation proceeds. 5. The expensive operation incurs cost without the approval promised by the Skill's core rules. ### Impact Assessment This flaw does not grant operating-system privileges or permit ...[truncated 599 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- Set daily budget (optional):
bash echo "DAILY_BUDGET=20.00" >> ~/.openclaw/workspace/.env- Test it:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- Set daily budget (optional):
bash echo "DAILY_BUDGET=20.00" >> ~/.openclaw/workspace/.env- Test it:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose promises preventive controls before
sessions_spawn, but the skill content mainly provides guidance, logging, and retrospective reporting rather than an enforceable gate. That mismatch is dangerous because users may rely on it as a hard cost-control mechanism when it does not actually prevent expensive actions, and it also introduces undeclared file reads/writes to tracking data.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` — This file (agent instructions)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `bin/cost-summary.js` — CLI: daily/monthly spend summary
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
First-Time Setup
- Create tracking file:
bash mkdir -p ~/.openclaw/workspace/notes cat > ~/.openclaw/workspace/notes/cost-tracking.md << 'EOF'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says the skill activates automatically when the user asks to spawn a subagent or requests a cost estimate, but it does not define narrower trigger phrases, scope limits, or exclusions. These are common intents that could overlap with many normal interactions, making invocation boundaries unclear.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented bypass phrase 'proceed without cost check' is generic and unconstrained, which creates a weak override path for a safety-control skill. If an agent treats that phrase as sufficient authority, prompt injection, accidental phrasing, or indirect user content could disable the approval gate and undermine the budget-protection purpose of the skill.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Examples
Example 1: Cheap Task (Auto-Approved)
text You: "Quick lookup: What's the capital of France?"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The example says the agent 'auto-approves' and 'spawns on Haiku,' which is an autonomous action affecting resource consumption without an explicit approval step. Even if the spend is small, repeated low-cost automatic spawns can accumulate cost and normalize bypassing user confirmation for actions that have billing impact.
- Content
text You: "Quick lookup: What's the capital of France?" Agent: [estimates $0.05, auto-approves, spawns on Haiku]Example 2: Expensive Task (Gated)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill instructs use of environment-backed configuration via
.envand implies stateful behavior, but the manifest does not declare any tool scope or permissions for environment/file access. This creates a transparency and least-privilege problem: operators cannot accurately assess what resources the skill expects to touch, increasing the chance of unauthorized reads or writes during execution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill requires logging all spawns to a workspace tracking file without clearly obtaining user consent for persistence of task details. Silent recording of prompts, task names, or model usage can expose sensitive operational or business information to anyone with access to the workspace notes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill explicitly creates persistent workspace state under
notes/cost-tracking.md, causing task metadata to accumulate across sessions. Persistent local records are not inherently malicious, but they can become a privacy and information disclosure risk if they store sensitive task names, budgets, or operational history without retention controls.- Content
Setup
- Create cost tracking file:
bash mkdir -p ~/.openclaw/workspace/notes touch ~/.openclaw/workspace/notes/cost-tracking.md
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The approval flow says low-cost operations may proceed and be logged silently, which normalizes unannounced file writes for routine activity. Even if the cost is low, the task content may still be sensitive, so hidden persistence increases privacy and data-handling risk.
- Content
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- SKILL.md:147