Security audit

ClawUsage Windows Hardlock

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its usage-monitoring purpose, but it uses sensitive OpenClaw credentials/session data and installs a long-lived hidden background task with weak containment.

Review this before installing if you would not want a skill to read OpenClaw auth/session files, query ChatGPT usage with your local token, cache usage/session snapshots under your profile, or install a hidden recurring Windows scheduled task. Only enable auto alerts if you accept those behaviors and know how to run auto off to remove the task.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: scripts/clawusage.ps1.txt:150
Finding: Long-Lived Hidden Scheduled Task Executes Mutable Scripts with Policy Bypass
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/clawusage-auto-worker.ps1.txt:63
Finding: Command Injection Through Unsafe Construction of cmd.exe Command Lines
Content: View full analysis
nul" if ($CaptureOutput) { $output = (& cmd /c $cmdLine | Out-String).Trim() return [pscustomobject]@{ ExitCode = $LASTEXITCODE Output = $output } } & cmd /c $cmdLine | Out-Null return [pscustomobject]@{ ExitCode = $LASTEXITCODE Output = "" } } ``` The arguments include values obtained from OpenClaw session metadata: ```powershell $target = $Session.LastTo if ([string]::IsNullOrWhiteSpace($target)) { $target = $Session.OriginTo } if ([string]::IsNullOrWhiteSpace($target)) { $target = $Session.OriginFrom } $target = Normalize-Target -Channel $channel -Target $target $account = $Session.LastAccountId if ([string]::IsNullOrWhiteSpace($account)) { $account = $Session.OriginAccountId } if ([string]::IsNullOrWhiteSpace($account)) { $account = "default" } ``` Those values are passed to the vulnerable function: ```powershell $sendRes = Invoke-OpenClaw -Arguments @("message", "send", "--channel", $delivery.Channel, "--account", $delivery.Account, "--target", $delivery.Target, "-m", $message, "--silent", "--json") -CaptureOutput ``` ### Technical Analysis The worker concatenates arguments into a single command string and passes that string to `cmd.exe / ...[truncated 2244 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:65
Finding: Recursive Script Discovery Permits Local Payload Substitution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly writes executable runtime files into a persistent directory under the user's profile ($env:USERPROFILE\.clawusage\skill-runtime) but does not disclose that behavior in the user-facing description. This is dangerous because it creates or overwrites local script files in a trusted per-user location, which can surprise users, complicate auditing, and increase the blast radius if the packaged scripts or resolved source directory are tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill runs PowerShell with -ExecutionPolicy Bypass, which suppresses an important local safeguard, yet the description does not warn users that this will occur. In context, this is more dangerous because the skill locates script files dynamically, copies them to a runtime directory, and then executes them directly, so bypassing execution policy materially lowers resistance to malicious or tampered script content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Language parameter is constrained with ValidateSet("english", "chinese"), forcing output into one of two specific languages. This is a locale/language restriction with no broader user opt-in or justification for excluding other languages.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes checking Codex usage and managing idle alerts/language, but this code additionally scans local JSONL session logs to aggregate per-message token usage history. Reading and processing detailed local conversation telemetry is not obviously required for idle reminder delivery, and the manifest does not clearly justify this deeper log-mining capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The auto-worker derives the last active channel, target, account, last activity time, idle duration, and optional local token summaries from local session data, then sends a composed message through the external openclaw messaging command. Even though this appears intended for idle alerts, it transmits behavioral metadata to an external messaging sink without explicit in-file consent or validation of whether the recovered target/channel is appropriate for notification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script registers a scheduled task that launches PowerShell with -ExecutionPolicy Bypass, which disables a key policy guard for every automated execution of the worker script. In this skill context, the task runs repeatedly and uses script paths and state derived from the local environment, so if the referenced script or its directory is modified, the bypass makes execution more permissive and reduces defense-in-depth.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The ValidateSet limits language selection to only "english" or "chinese", which is a natural-language locale restriction. The file does not indicate that this limitation is optional, user-configurable beyond those two choices, or justified by a region-specific requirement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script reads a locally stored bearer token from the user's OpenClaw auth profile and uses it to make a direct request to chatgpt.com. That exceeds a purely local monitoring role and creates an undisclosed credential-handling/data-egress path; even if intended to improve accuracy, it expands trust boundaries and could expose account-scoped data or normalize token reuse by skills.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Accessing auth-profiles.json to locate and extract bearer tokens is sensitive behavior not clearly necessary for a chat-triggered usage monitor. In a skill context, local credential access materially increases risk because the skill runs with user context and can silently expand from status reporting into credential use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script not only accesses a local bearer token but transmits it in an Authorization header to an external service without any user-facing disclosure in the skill. Secret use without transparency is dangerous because users invoking a simple monitoring command may not realize credentials are being harvested from disk and used for outbound requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script serializes notification state and writes it to clawusage-auto-state.json, persisting session key, target, account, and timestamps under the user's profile. There is no confirmation, user-facing notice, or inline documentation warning that this tracking file is created and updated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: When caching is enabled, the script creates a directory under the user profile and writes snapshot JSON containing usage and session details. The file lacks a user-facing warning or explanatory comment near the write path that local data will be persisted to disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.