Security audit

Token Cost Guard

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it reads local OpenClaw or Hermes usage records to calculate token costs, writes local reports/state, and only sends alerts when explicitly configured.

Install only if you are comfortable with the skill reading local OpenClaw or Hermes usage logs and Hermes state.db to summarize token spend. Expect it to leave local cost reports and snapshot state on disk, and use --send-openclaw only when you intentionally want reports sent to a configured channel/target.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The invocation description is broad enough to match generic requests like tracking spend or monitoring usage, which could cause the agent to trigger this skill in ordinary conversations without the user understanding it will inspect local logs and state. In context, the skill accesses sensitive operational records from OpenClaw/Hermes, so overbroad activation increases the chance of unintended data access and filesystem changes.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The documentation states that the skill writes reports and snapshot state files, but it does not clearly warn the user before filesystem modifications occur. While the writes appear limited to runtime state/report directories, silent persistence can still surprise users, overwrite expectations, or leave sensitive cost reports on disk.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The default prompt is a broad natural-language trigger that can cause the skill to activate in response to loosely related user requests about token usage or cost monitoring. Because this skill reads runtime logs and state from the active ecosystem, over-broad activation increases the chance of unintended access to potentially sensitive operational data and surprise execution without clear user intent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Enabling implicit invocation without tight trigger boundaries allows the agent to invoke this skill automatically based on vague semantic matches. In this skill's context, automatic invocation is riskier because the skill is designed to inspect local runtime records such as OpenClaw session logs or Hermes state.db, which may expose sensitive usage, model, or operational metadata when the user did not explicitly request that access.

Static analysis

No suspicious patterns detected.