ClawHub
Back to skill

Security audit

大模型Token成本节约

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent as a token-compression helper, but its optional telemetry and credential persistence need user review before installation.

Install only if you want a tool that may modify your Python environment and wrap local LLM clients. Keep telemetry disabled unless you are comfortable sending token/model/cost metrics to mrkjai.com, do not include prompts or identifiers in metadata, and avoid storing the dashboard API key in shell startup files on shared or sensitive machines. Prefer reviewing or pinning the installer instead of running the remote one-liner directly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
#   Compressed: 1298 tokens (40.0%)
    #   Model: claude-sonnet-4
    #   Time: 2026-06-21T10:23:01
    perf_output = os.popen("headroom perf 2>/dev/null").read()
    if not perf_output.strip():
        return []
Confidence
95% confidence
Finding
The script invokes an external shell via os.popen("headroom perf 2>/dev/null") as a fallback data source. Even though the command string is constant, it still depends on shell resolution and PATH, so a malicious or trojaned `headroom` binary/script in the execution environment could be executed unexpectedly; shell invocation also broadens attack surface compared to direct library or subprocess calls.

Tainted flow: 'INGEST_URL' from os.environ.get (line 43, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/json",
    }
    try:
        resp = requests.post(INGEST_URL, json=event, headers=headers, timeout=10)
        resp.raise_for_status()
        return resp.json()
    except requests.exceptions.RequestException as e:
Confidence
95% confidence
Finding
The script builds INGEST_URL from the MRKJAI_API_BASE environment variable and then sends telemetry plus the X-API-Key header to that URL. If MRKJAI_API_BASE is overridden to an attacker-controlled host, the API key and uploaded usage data will be exfiltrated via a legitimate HTTPS request, creating an SSRF-style sink and credential leakage path.

Tainted flow: 'INGEST_URL' from os.environ.get (line 43, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/json",
    }
    try:
        resp = requests.post(INGEST_URL, json={"events": events}, headers=headers, timeout=15)
        resp.raise_for_status()
        return resp.json()
    except requests.exceptions.RequestException as e:
Confidence
95% confidence
Finding
The batch upload path has the same tainted flow: MRKJAI_API_BASE influences INGEST_URL, and requests.post sends potentially large event data plus the API key to that derived endpoint. An attacker who can influence the environment can redirect uploads to an external server and collect credentials and telemetry.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to perform shell execution, file writes, environment-variable modification, and network access, but declares no permissions. This mismatch is dangerous because users and the platform may not realize the skill can install packages, download models, persist API keys, modify shell rc files, and transmit data externally.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Executing an external command as a silent fallback means a local dashboard/reporting script can trigger code execution outside the Python process whenever the database is absent or unreadable. In this skill context, that is more concerning because the tool is positioned as a convenience utility and may be run on developer workstations with sensitive credentials, where PATH hijacking or compromised local tooling could turn the fallback into arbitrary command execution.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
This script adds automatic external reporting behavior that is not necessary for the core token-compression function described by the skill. In the context of an agent skill, undisclosed or loosely scoped telemetry increases the risk of data leaving the environment unexpectedly, especially because the reported statistics are derived from model usage and may reveal operational patterns.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script prompts for or reads an API key and uses it to send data to a third-party service, even though that capability is not required to perform prompt compression itself. In a skill ecosystem, requesting credentials for ancillary telemetry expands the attack surface and can normalize unnecessary secret collection.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The script collects and persists a user API key in ~/.workbuddy/headroom_config.json for a telemetry feature that is ancillary to the skill’s core purpose of token-cost reduction. While local API key storage is not inherently malicious, storing credentials in a plaintext config file without permission hardening or use of the OS keychain increases the risk of credential disclosure to other local users, backup systems, or malware.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The privacy notice tells users that only token counts, model names, and compression statistics are uploaded, but the implementation accepts arbitrary metadata and includes it in the event body sent to the remote endpoint. This creates a direct mismatch between user consent and actual data handling, and could lead to accidental exfiltration of sensitive prompt content, identifiers, or internal context if callers populate metadata unsafely.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad phrases such as '省钱' and 'LLM优化', which can cause the skill to activate in loosely related conversations. Over-broad invocation is risky here because activation can lead to package installation, shell commands, model downloads, and optional external telemetry flows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document instructs clients to send an API key plus arbitrary metadata to a third-party endpoint, but it does not present an explicit privacy notice, data-sharing warning, or strong guidance on limiting metadata contents. Because `metadata` is free-form JSON and examples include session identifiers and agent details, implementers may unknowingly transmit sensitive operational or user-linked data off-box.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation states that CCR stores original, uncompressed content in a local SQLite database for later retrieval, but it does not clearly warn users that sensitive prompts, code, secrets, or internal context may persist on disk. In the context of a prompt-compression tool, this is security-relevant because users may assume compression reduces exposure, while reversible caching can silently create a new data-at-rest risk on developer machines or shared environments.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script performs `pip install` directly into the user's environment without an explicit warning, confirmation prompt, or isolation via a virtual environment. This is dangerous because it modifies the local system state, may introduce unreviewed dependencies, and can unexpectedly affect existing Python environments or developer tooling.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 单条上报
curl -s -X POST https://mrkjai.com/api/ingest/headroom \
  -H "X-API-Key: opc_user_你的40位hex" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
96% confidence
Finding
The skill defines outbound transmission of usage statistics and an API key to an external domain, and later automates reporting after compression runs. Even though it claims to send only metrics and to be opt-in, this still creates a real exfiltration channel and exposes sensitive metadata such as model usage patterns, costs, and persistent credentials to a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
## 六、调用示例

### curl 单条

```bash
curl -X POST https://www.mrkjai.com/api/ingest/headroom \
Confidence
93% confidence
Finding
The examples document external transmission of usage telemetry, including an API key and event metadata, to `https://www.mrkjai.com/api/ingest/headroom`. In the context of a token-saving skill, this is more sensitive because the surrounding product handles prompts and model usage, so even seemingly harmless telemetry fields can become linked to user sessions, agent identity, or internal operations if not tightly minimized and consented.

External Transmission

Medium
Category
Data Exfiltration
Content
"Content-Type": "application/json",
    }
    try:
        resp = requests.post(INGEST_URL, json=event, headers=headers, timeout=10)
        resp.raise_for_status()
        return resp.json()
    except requests.exceptions.RequestException as e:
Confidence
86% confidence
Finding
The script transmits collected usage metrics to an external service. In isolation, external transmission is expected for telemetry, but in this skill context it is more sensitive because the core advertised capability is local prompt compression, so network export of derived usage data may be unexpected and can leak operational metadata.

External Transmission

Medium
Category
Data Exfiltration
Content
"Content-Type": "application/json",
    }
    try:
        resp = requests.post(INGEST_URL, json={"events": events}, headers=headers, timeout=15)
        resp.raise_for_status()
        return resp.json()
    except requests.exceptions.RequestException as e:
Confidence
86% confidence
Finding
The batch endpoint sends multiple events externally, amplifying the amount of operational data that can leave the environment in one request. Because this is auxiliary to compression, the data transfer is riskier than a user might expect from the skill description alone.

External Script Fetching

Low
Category
Supply Chain
Content
不想手动配置？一行命令完成安装+验证：

```bash
bash <(curl -sSL https://raw.githubusercontent.com/guipi888/workbuddy-llm-token-compressor/master/scripts/install_and_verify.sh)
```

脚本自动执行：检测 Python 版本 → pip install → headroom doctor → 展示可用后端 + 快速接入命令。
Confidence
98% confidence
Finding
The one-line installer executes a remote script directly from GitHub via curl piped to bash. This is dangerous because any compromise of the repository, branch, transport endpoint, or script contents results in immediate arbitrary code execution on the user's machine.

External Script Fetching

Low
Category
Supply Chain
Content
#!/usr/bin/env bash
# install_and_verify.sh — 大模型 Token 成本节约工具 一键安装验证脚本
# 用法：curl -sSL https://raw.githubusercontent.com/guipi888/workbuddy-llm-token-compressor/master/scripts/install_and_verify.sh | bash
# 或本地执行：bash scripts/install_and_verify.sh

set -e
Confidence
95% confidence
Finding
The script explicitly recommends fetching a remote script from GitHub and piping it directly to `bash`, which prevents users from reviewing the content before execution. In this skill context, the installer is intended for easy adoption, so users are more likely to run the one-liner as-is; if the remote content or distribution path is compromised, arbitrary code will run immediately on the user's machine.

Chaining Abuse

High
Category
Tool Misuse
Content
#!/usr/bin/env bash
# install_and_verify.sh — 大模型 Token 成本节约工具 一键安装验证脚本
# 用法：curl -sSL https://raw.githubusercontent.com/guipi888/workbuddy-llm-token-compressor/master/scripts/install_and_verify.sh | bash
# 或本地执行：bash scripts/install_and_verify.sh

set -e
Confidence
97% confidence
Finding
Piping network-retrieved content directly into `bash` is a classic command-chaining risk because it combines retrieval and execution into a single unreviewable step. This is especially risky in an installation script for a developer tool, where users may run the command in trusted environments containing credentials, SSH keys, or API tokens, magnifying the blast radius of any compromise.

Static analysis

No suspicious patterns detected.