AI Token消耗监控

Security checks across malware telemetry and agentic risk

Overview

This skill transparently reads local OpenClaw session logs to summarize token usage and saves only aggregate usage statistics.

Install only if you are comfortable with a local tool reading session logs to calculate token usage. Consider narrowing the activation phrases or requiring confirmation before log access if accidental invocation would be a concern.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger phrases include very generic terms such as 'Token', '费用', and '统计', which are likely to appear in ordinary conversations unrelated to this skill. Overly broad activation can cause unintended invocation, leading the skill to read logs or write reports when the user did not explicitly request sensitive monitoring behavior.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal