Token Cost Guard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 0.2.4

Overview

The skill appears purpose-built for token cost monitoring, but it can be auto-invoked while reading broad local agent logs and runtime databases.

Review before installing. This skill should only be enabled where you are comfortable letting it inspect OpenClaw/Hermes usage records across local agents; prefer explicit invocation, restrict it to specific agents or paths when possible, and only use --send-openclaw with trusted channels and targets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Enabling implicit invocation without a tightly constrained activation description creates a significant risk that the platform will auto-run this skill on loosely related requests. In context, this is more dangerous because the skill is designed to inspect OpenClaw/Hermes logs and databases from the active environment, so accidental activation can expose sensitive operational metadata or perform monitoring actions the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents shell execution plus environment, file read, and file write behavior, but it declares no explicit tool scope or permissions boundary. In agent ecosystems that auto-route or auto-approve skills, this can lead to over-broad execution authority and makes it harder for policy engines or users to understand what the skill may access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description contains broad triggers like tracking token spend, realtime cost, spending spikes, and monitoring multiple model families across OpenClaw or Hermes, which are likely to match many generic monitoring requests. That increases the chance the skill is invoked unintentionally, causing it to read runtime logs/state and potentially send alerts when the user did not explicitly request this specific skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file states the skill will 'warn in Chinese reports', which imposes a specific language choice in the skill's behavior. No opt-in, language selection mechanism, or justification for a Chinese-only output policy is documented.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default prompt is phrased as a broad natural-language trigger for checking token spend from the active runtime, which can cause the skill to be invoked in situations the user did not explicitly intend. Because this skill reads local runtime records and may generate alerts, over-broad activation increases the chance of unintended access to logs/state and unnecessary disclosure of operational or cost data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description states the skill provides a "Chinese threshold alert report skill," which implies a fixed output language. This is a natural-language policy concern because it imposes a specific language/locale without documenting user opt-in or offering alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code emits status reasons, table headings, and reports in Chinese only, including hard-coded Chinese strings in alert reasons and rendered output. That enforces a specific language/locale for all users without offering a choice or documenting a justified regional constraint, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes reading ecosystem records, comparing snapshots, and sending an alert report, but frames the skill around monitoring local OpenClaw/Hermes usage records. The code additionally invokes the external openclaw message send command to deliver reports to a chosen channel/target, which is a separate messaging capability not reflected in the manifest description's implementation scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

For a token-cost monitoring skill, spawning a subprocess is not an obvious requirement unless the manifest explicitly scopes alert transport through a CLI. Here the implementation uses subprocess.run to execute openclaw message send, adding command-execution capability beyond straightforward log/state analysis.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/token_cost_guard.py (reported line 1003)May include surrounding context.

python

command.extend(["--account", args.account])
    if args.send_dry_run:
        command.append("--dry-run")
    subprocess.run(command, check=True, timeout=60)


def run_once(args: argparse.Namespace, prices: dict[str, dict[str, float]]) -> int:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says the skill will generate or send a Chinese alert report, but does not indicate any user choice, locale detection, or opt-in. Forcing a fixed-language outbound report can miscommunicate cost or alert details, and if the skill sends notifications automatically, users may not understand or notice important spending alerts or the content being transmitted.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description is broad enough to trigger on generic requests about token usage, cost, or alerts without clearly limiting when the skill should or should not run. In an agent ecosystem, ambiguous activation can cause the skill to access runtime logs or state unexpectedly, increasing the chance of unnecessary data exposure or unintended autonomous actions.

Content

No source excerpt is available for this finding.