Model Usage Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:43 PM UTC
• Version: 1.0.1

Overview

The skill is a plausible local model-usage monitor, but it under-discloses sensitive session reading and installation behavior that can add recurring execution.

Install only if you are comfortable with the skill reading OpenClaw main-agent session metadata from local session files and placing executable code under ~/.openclaw/workspace/.lib. Review or disable setup.py's automatic cron behavior first, and verify any OpenClaw cron entry before relying on hourly alerts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: monitor.py:26

Finding

Undisclosed Access to Main-Agent Session Transcripts

Content

View full analysis

Dict: """Parse session files to obtain model usage details for each session.""" session_stats = {} if not os.path.exists(SESSIONS_DIR): return session_stats try: session_files = [ f for f in os.listdir(SESSIONS_DIR) if f.endswith('.jsonl') ] except Exception: return session_stats for session_file in session_files[:20]: session_path = os.path.join(SESSIONS_DIR, session_file) session_key = session_file.replace('.jsonl', '') try: with open( session_path, 'r', encoding='utf-8', errors='ignore' ) as f: lines = f.readlines() msg_count = 0 models_used = set() last_model = None for line in lines[-100:]: try: data = json.loads(line) msg = data.get('message', {}) if msg.get('role') == 'assistant': msg_count += 1 metadata = data.get('metadata', {}) model = metadata.get('model') if model: short = extract_model_name(model) models_used.add(short) last_model = short except: continue if msg_count > 0: session_stats[session_key[:20]] = { "message_count": msg_count, "models_used": list(mo ...[truncated 2671 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: setup.py:49

Finding

Configuration Schema Mismatch Causes Partial Installation and Disables Scheduled Monitoring

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The declared scope says the skill only performs local read-only monitoring plus notifications, yet the documented install behavior includes automatic cron-based configuration changes. This mismatch is dangerous because it hides persistence and system modification behind a minimized permission statement, undermining informed consent and increasing the risk of unnoticed background execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation asserts 'read-only' and 'zero side effects on system state', but the installation section says a cron job is automatically created. That is a persistent system configuration change and directly contradicts the declared permissions, which can mislead users into granting trust to behavior that alters execution on a schedule.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · lib/monitor.py (reported line 491)May include surrounding context.

python

import time
        try:
            while True:
                os.system('clear' if os.name != 'nt' else 'cls')
                semantic_stats = parse_semantic_log(args.lines)
                gateway_stats = parse_gateway_log(args.lines * 2)
                usage = estimate_model_usage(semantic_stats, gateway_stats)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · monitor.py (reported line 491)May include surrounding context.

python

import time
        try:
            while True:
                os.system('clear' if os.name != 'nt' else 'cls')
                semantic_stats = parse_semantic_log(args.lines)
                gateway_stats = parse_gateway_log(args.lines * 2)
                usage = estimate_model_usage(semantic_stats, gateway_stats)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation instructions mention automatic cron creation but do not prominently warn that this modifies system configuration and establishes recurring execution. Users may install the skill expecting a passive script, not a persistent scheduled task, which increases the chance of unauthorized or misunderstood background activity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The comment on L04 presents the skill as having no notable side effects beyond transparency, yet the script creates directories, copies files into a shared library location, and marks a Python script executable. The later usage text also advertises 'real-time monitoring' and 'alert-check' capabilities not reflected in the minimalist safety claim, creating an intent/documentation mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and user-facing strings are written entirely in Chinese, and the file does not offer any language/locale selection or state that the tool is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The header explicitly states '全部使用本地 Ollama，零 API 调用' ('all local Ollama, zero API calls'), which conveys a local-only usage context. However, the script parses gateway logs and computes usage/costs for Claude, Gemini, GPT, GLM, and other external-provider model identifiers, contradicting that stated intent rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing natural language in Chinese in the module docstring and usage guidance, and the rest of the script continues that pattern in console messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The top-level documentation explicitly states '全部使用本地 Ollama，零 API 调用' ('all local Ollama, zero API calls'). However, the code parses logs and computes pricing for Claude, Gemini, GPT, GLM, and other remote-provider model identifiers, indicating the monitored system is not limited to local Ollama usage. This is an active contradiction between documented intent and what the code is built to analyze.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup script writes a Python file into the user's workspace .lib directory without prior confirmation or warning. In the context of agent skills, silently placing executable code into a commonly reused workspace location increases the risk of persistence, later execution, and user confusion about provenance.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup.py (reported line 39)May include surrounding context.

python

def setup_cron_job(config):
    """设置自动监控 Cron Job"""
    # 检查是否已存在
    result = subprocess.run(
        ["openclaw", "cron", "list"],
        capture_output=True,
        text=True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code silently creates a scheduled OpenClaw cron task that repeatedly triggers agent-driven execution of a workspace script. In a skill package, unprompted persistence is a significant security concern because it survives the initial install and can repeatedly execute modified or malicious code later.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This code creates a persistent OpenClaw cron task that will later cause an agent to execute a script from the user's workspace, and it does so automatically during setup. Even though subprocess.run is called safely with a list, the dangerous behavior is the silent establishment of recurring execution/persistence without explicit user consent, which can be abused if the installed monitor script or config is malicious.

Content

Scanner excerpt · setup.py (reported line 62)May include surrounding context.

python

"--description", "每小时检查模型使用告警"
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode == 0:
        print("✅ Cron Job 已创建: 每小时自动检查")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The setup script immediately executes the newly installed workspace script as a test, which means installation triggers code execution from a copied file without separate approval. In a hostile or tampered skill, this turns setup into an execution path for arbitrary code under the user's account.

Content

Scanner excerpt · setup.py (reported line 72)May include surrounding context.

python

def test_monitor():
    """测试监控脚本"""
    script = os.path.join(LIB_DIR, "model_usage_monitor_v2.py")
    result = subprocess.run(
        ["python3", script, "--alert-check"],
        capture_output=True,
        text=True

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file structure explicitly labels the skill documentation as "Chinese," which can reflect a language or locale restriction. Under the policy rule, language-specific constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

该文件整体以中文呈现，文件名也明确限定为中文版本，但文档中未说明这是可选语言版本或提示用户可选择其他语言。根据规则，若技能在自然语言层面强制特定语言且没有用户选择或明确正当说明，可视为语言/locale 政策风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Most of the operational instructions and descriptions are presented in Chinese, which can force a specific language on users without opt-in. The file does not state that the skill is intended only for a Chinese-speaking audience or provide an alternative language option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation frames the file as an installation/configuration script, but the code also executes the installed monitor immediately. This mismatch can mislead users about the setup script's behavior and reduce informed consent, especially in a security-sensitive agent skill context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup script's user-facing description and messages are written in Chinese, indicating a fixed language/locale choice. There is no indication that the user can opt into another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The comment suggests a conventional cron-based monitor setup, but the implementation actually creates an OpenClaw task that sends an agent message instructing script execution. In an agent ecosystem, this distinction matters because it adds an indirect code-execution/persistence path that may be less visible to users than a normal cron entry.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.