ClawHub
Back to skill

Security audit

Cost Optimizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cost-optimization tool, but it reads global agent settings and can persist recent conversation content in plaintext, so users should review it before installing.

Install only if you are comfortable with the skill reading OpenClaw/Claude settings and usage logs from your home directory and writing a project-local .context-snapshot.md that may include recent prompts, code, tool output, or secrets. Prefer using it after adding snapshot files to .gitignore, reviewing generated config before applying it, and avoiding global config reads unless you explicitly need them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:270
Finding

Overly Broad Reading of User-Global Agent Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 270-277
Vulnerability Type: Excessive access to user-global configuration files
Risk Level: Medium

Vulnerable Code

bash
# OpenClaw 配置
cat ~/.openclaw/config.json 2>/dev/null
cat ./openclaw.json 2>/dev/null

# Claude Code 配置
cat ~/.claude/settings.json 2>/dev/null
cat ./.claude/settings.json 2>/dev/null

Technical Analysis

The heartbeat workflow instructs the agent to read the complete contents of user-global OpenClaw and Claude configuration files. These files can contain sensitive values unrelated to heartbeat optimization, including API credentials, private service endpoints, authentication headers, hooks, executable commands, and other user-specific configuration.

Reading entire global configuration files violates the principle of least privilege because heartbeat optimization only requires a limited subset of configuration keys. Although the audited project does not contain code that transmits these values externally, the full contents can enter the active agent context, tool transcripts, logs, or subsequent generated files.

Redirecting errors to /dev/null suppresses visibility when access fails but does not reduce the amount of data accessed when the files are readable.

Attack Path

  1. A user stores a credential or private endpoint in ~/.openclaw/config.json or ~/.claude/settings.json.
  2. The user invokes the heartbeat optimization workflow.
  3. The agent follows the documented instructions and reads each global settings file in full.
  4. Sensitive values become part of the agent's active context or tool history.
  5. A later response, diagnostic report, context snapshot, or unrelated prompt causes those values to be reproduced or persisted.

No direct network exfiltration mechanism was identified in the audited project. Exploitation therefore depends on subsequent disclosure through agent output, logs, or context pe ...[truncated 644 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not read complete user-global configuration files by default.
  2. Request explicit user consent before accessing files under ~/.openclaw or ~/.claude.
  3. Use a local structured JSON parser to extract only the heartbeat-related keys required by the workflow.
  4. Recursively redact fields whose names match patterns such as token, secret, password, credential, authorization, api_key, or private_key.
  5. Prevent raw configuration contents from being included in reports, logs, model prompts, or context snapshots.
  6. Prefer project-level configuration unless the user specifically asks to inspect global settings.
  7. Display the exact files and fields that will be accessed before performing the read.
  8. Report access failures explicitly rather than silently suppressing all errors when diagnostic information is appropriate.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:214
Finding

Plaintext Persistence of Complete Recent Conversation Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 214-235; configured by openclaw.json, lines 134-141
Vulnerability Type: Insecure storage of potentially sensitive conversation data
Risk Level: Medium

Vulnerable Code

markdown
将压缩后的上下文摘要写入 `.context-snapshot.md`：

```markdown
# Context Snapshot
> 生成时间: {timestamp}
> 原始 tokens: {original} → 压缩后: {compressed} (节省 {ratio}%)

## 关键决策
- {decision_1}
- {decision_2}

## 活跃文件
- {file_1}: {summary}
- {file_2}: {summary}

## 待处理事项
- {todo_1}
- {todo_2}

## 最近对话（完整）
{last_5_turns}
text

The destination is configured as follows:

```json
"context": {
  "max_context_tokens": 80000,
  "auto_compress_threshold": 50000,
  "compression": {
    "keep_recent_turns": 5,
    "history_summary_depth": 10,
    "tool_result_strategy": "key_output_only",
    "file_content_strategy": "path_and_summary",
    "snapshot_path": ".context-snapshot.md"
  }
}

Technical Analysis

The compression workflow directs the agent to write a predictable plaintext file named .context-snapshot.md and to include the latest five conversation turns in full. Recent messages can contain API credentials, passwords, proprietary source code, personal information, private paths, sensitive tool output, or confidential business data.

The workflow does not specify secret detection, redaction, restrictive file permissions, encryption, a retention period, secure deletion, or user confirmation before persistence. It also does not require the snapshot file to be excluded from version control. Because the destination is inside the project directory, it may be staged and committed along with ordinary project files.

The TypeScript compression function reinforces this behavior by retaining recent messages without transformation:

typescript
const recentMessages = messages.slice(-keepRecentTurns * 2);
// ...
compressedMessages.push(...recent
...[truncated 1642 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not persist complete recent turns by default; store concise summaries instead.
  2. Require explicit confirmation before writing conversation content to disk.
  3. Apply recursive secret and sensitive-data redaction before snapshot generation.
  4. Exclude raw tool output, environment values, authorization headers, private keys, and credential-like strings.
  5. Create snapshots with owner-only permissions, such as mode 0600 on supported systems.
  6. Add .context-snapshot.md and alternative snapshot names to .gitignore.
  7. Use a randomized, user-private storage location rather than a predictable project-root path when project-local storage is unnecessary.
  8. Provide a configurable retention period and a secure deletion command.
  9. Clearly display what information will be stored and where it will be written.
  10. Add tests confirming that common API keys, bearer tokens, passwords, private keys, and sensitive tool results are removed before persistence.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

This duplicate match points to the same risky behavior: direct access to ~/.claude/settings.json in the home directory. Home-directory agent config access is especially sensitive because it can disclose cross-project configuration and secrets irrelevant to the current task.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

cat ./openclaw.json 2>/dev/null

Claude Code 配置

cat ~/.claude/settings.json 2>/dev/null cat ./.claude/settings.json 2>/dev/null

text

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

This duplicate match points to the same risky behavior: direct access to ~/.claude/settings.json in the home directory. Home-directory agent config access is especially sensitive because it can disclose cross-project configuration and secrets irrelevant to the current task.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

cat ./openclaw.json 2>/dev/null

Claude Code 配置

cat ~/.claude/settings.json 2>/dev/null cat ./.claude/settings.json 2>/dev/null

text

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

This duplicate match refers to the project-local .claude/settings.json access already noted above. While not as severe as home-directory access, it still deserves caution because project agent settings may contain sensitive configuration that the skill should not inspect silently.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

Claude Code 配置

cat ~/.claude/settings.json 2>/dev/null cat ./.claude/settings.json 2>/dev/null

text

**Step 2: 生成优化配置**

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

This duplicate match refers to the project-local .claude/settings.json access already noted above. While not as severe as home-directory access, it still deserves caution because project agent settings may contain sensitive configuration that the skill should not inspect silently.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

Claude Code 配置

cat ~/.claude/settings.json 2>/dev/null cat ./.claude/settings.json 2>/dev/null

text

**Step 2: 生成优化配置**

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

md
使用 `index.ts` 中的工具函数计算：

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

md
使用 `index.ts` 中的工具函数计算：

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 546)May include surrounding context.

md
使用 `index.ts` 中的工具函数计算：

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 558)May include surrounding context.

md
使用 `index.ts` 中的工具函数计算：

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

This duplicate match again corresponds to project-local .claude/settings.json access during config generation. The risk remains unnecessary exposure of agent configuration data without an explicit user warning or a least-privilege design.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

读取现有配置文件：

bash
cat ./openclaw.json 2>/dev/null || echo "{}"
cat ./.claude/settings.json 2>/dev/null || echo "{}"

Step 2: 生成配置

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

This duplicate match again corresponds to project-local .claude/settings.json access during config generation. The risk remains unnecessary exposure of agent configuration data without an explicit user warning or a least-privilege design.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

读取现有配置文件：

bash
cat ./openclaw.json 2>/dev/null || echo "{}"
cat ./.claude/settings.json 2>/dev/null || echo "{}"

Step 2: 生成配置

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README states that context compression can generate a .context-snapshot.md file but does not clearly warn that conversation history, tool outputs, and possibly sensitive file content may be written to disk. In an agent/tooling context, silent persistence of prompts, code, paths, or secrets increases the risk of unintended local disclosure through backups, sync tools, shared workspaces, or later exfiltration by other processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill writes a context snapshot containing recent conversation content, decisions, active files, and summaries to disk without an explicit user-facing warning. Persisting conversation-derived content can unintentionally store secrets, proprietary code details, or other sensitive material in a plain-text file that may later be committed or accessed by other tools.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The context compression flow explicitly retains and writes conversation summaries, file summaries, and recent turns into .context-snapshot.md, creating a durable plain-text artifact of potentially sensitive interactions. Because the content is derived from user prompts, tool outputs, and file contents, it may capture secrets, internal architecture, or proprietary code context in a form that is easy to leak or accidentally commit.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to read global user configuration and usage-related files from home-directory locations, expanding access beyond the current project without an explicit necessity boundary or consent step. This increases exposure of sensitive personal settings and environment-wide metadata that are unrelated to a single repository’s cost optimization task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest frames the skill as a cost optimization toolkit for routing, compression, heartbeat tuning, reports, and config generation. However, the documented heartbeat rule embeds a shell command that scans the project filesystem for recent file changes, which is a broader system-monitoring capability not clearly justified by merely generating optimization advice or config.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The usage reporting and logging design persists detailed session metadata including timestamps, models, token counts, task types, routing decisions, and costs. Over time this can reveal sensitive work patterns, project intensity, operating hours, and development behavior, especially when stored in per-user logs under the home directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This TypeScript file contains natural-language comments, labels, and generated user-facing strings primarily in Chinese, including report recommendations and chart summaries. Because the skill does not indicate that Chinese is optional or region-specific, it appears to impose a specific language/locale without user opt-in, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The routing rule relies on broad keywords like status, health, alive, and cron, which can appear in ordinary user requests that are not low-risk heartbeat tasks. In this skill’s context, a misclassification can silently downgrade substantive requests to a cheaper model, reducing reliability and potentially causing incorrect actions or incomplete analysis in operational workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file-operations rule uses ambiguous triggers such as read, move, complete, suggest, and rename, which are common in many normal development requests and not limited to low-risk file operations. In a cost-optimizer skill, that broad matching can route more complex or sensitive coding tasks to a weaker model, increasing the chance of bad edits, misunderstood intent, or unsafe automation recommendations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code-generation rule includes very broad terms like write, create, implement, explain, and test, which are likely to match a large fraction of developer requests. In this skill, such overbroad routing can incorrectly steer tasks and interact unpredictably with other rules and degradation logic, causing underpowered handling of security-relevant or high-complexity work despite seemingly innocuous phrasing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The title and the entire document are written in Chinese, and there is no indication that other languages are supported or that Chinese is required for a documented region-specific reason. Under the language/locale policy rule, presenting the skill guidance in a single forced language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README says the skill reads ~/.openclaw/usage-log.jsonl for reporting but does not disclose that it accesses historical data from the user's home directory, which may contain sensitive metadata about activity, prompts, models, timing, or usage patterns. While this is less severe than writing full context snapshots, undisclosed access to home-directory logs can still surprise users and expose private behavioral data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill reads configuration files from home-directory and agent-specific locations without clearly warning the user that personal settings may be inspected. Even read-only access can expose tokens, model preferences, paths, and operational metadata that users may not expect a cost tool to consume automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The usage report feature reads per-user usage logs and derives behavioral and cost analytics without an explicit privacy notice. Those logs can reveal work cadence, task types, model usage, and other sensitive activity patterns even if they do not contain raw secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The config comment and several descriptions are written in Chinese, but the file does not indicate that language choice is user-selectable or intentionally limited to a region-specific audience. That can violate a language/locale policy when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.