Token Stats

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:57 AM UTC
• Version: 2.6.1

Overview

This appears to be a genuine local AI-usage statistics tool, but its updater can replace its own files from a mismatched package name and it makes persistent PATH/config changes, so it needs Review before installation.

Review carefully before installing. The statistics feature reads local assistant logs/databases, and setup changes your persistent PATH by adding a wrapper command. Avoid using the built-in agent-usage-stats update/--update path until the package identifier and update verification are fixed; prefer the canonical ClawHub package update and verify the installed files. On Windows/WSL, be aware that saved paths in ~/.config/agent-usage-stats/paths.json influence WSL execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: agent-usage-stats.py:4537

Finding

Self-update uses an inconsistent package identifier and replaces active Skill files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: agent-usage-stats.py:192

Finding

Configurable WSL database paths are interpolated into executable Python source

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (43)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.en.md (reported line 616)May include surrounding context.

l steps above.

Cause 2: Ran setup but haven't opened a new terminal → setup writes PATH to system config. Open a new terminal for it to take effect.

Cause 3: setup PATH write failed → Re-run setup and check for errors. If needed, add PATH manually:

macOS (zsh):

bash

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.zshrc
source ~/.zshrc

Linux (bash):

bash

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
source ~/.bashrc

Windows (PowerShell, current session only):

powershell

$env:PATH += ';' + "$env:USERPROFILE\.local\bin"

❓ Permission denied when running agent-usage-stats

macOS / Linux only. Cause: wrapper script lacks execute permission.

bash

chmod +x ~/.local/bin/agent-usage-stats
# Or just re-run setup
python3 ~/skills/ai-agent-usage-stats/agent-usage-stats.py setup

Windows users are not affected (.cmd files don't need execute permission).

Runtime issues

❓ My agent isn't show

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 843)May include surrounding context.

l steps above.

Cause 2: Ran setup but haven't opened a new terminal → setup writes PATH to system config. Open a new terminal for it to take effect.

Cause 3: setup PATH write failed → Re-run setup and check for errors. If needed, add PATH manually:

macOS (zsh):

bash

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.zshrc
source ~/.zshrc

Linux (bash):

bash

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
source ~/.bashrc

Windows (PowerShell, current session only):

powershell

$env:PATH += ';' + "$env:USERPROFILE\.local\bin"

❓ Permission denied when running agent-usage-stats

macOS / Linux only. Cause: wrapper script lacks execute permission.

bash

chmod +x ~/.local/bin/agent-usage-stats
# Or just re-run setup
python3 ~/skills/ai-agent-usage-stats/agent-usage-stats.py setup

Windows users are not affected (.cmd files don't need execute permission).

Runtime issues

❓ My agent isn't show

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.zh.md (reported line 843)May include surrounding context.

l steps above.

Cause 2: Ran setup but haven't opened a new terminal → setup writes PATH to system config. Open a new terminal for it to take effect.

Cause 3: setup PATH write failed → Re-run setup and check for errors. If needed, add PATH manually:

macOS (zsh):

bash

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.zshrc
source ~/.zshrc

Linux (bash):

bash

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
source ~/.bashrc

Windows (PowerShell, current session only):

powershell

$env:PATH += ';' + "$env:USERPROFILE\.local\bin"

❓ Permission denied when running agent-usage-stats

macOS / Linux only. Cause: wrapper script lacks execute permission.

bash

chmod +x ~/.local/bin/agent-usage-stats
# Or just re-run setup
python3 ~/skills/ai-agent-usage-stats/agent-usage-stats.py setup

Windows users are not affected (.cmd files don't need execute permission).

Runtime issues

❓ My agent isn't show

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independently reported description-behavior mismatch reinforces that the skill's public description omits privileged system changes and broader data-handling features. When a skill claims 'every time you choose interactively' but also supports direct targeting, multi-agent operation, and system modification, users may not understand the true execution and privacy/security footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independently reported description-behavior mismatch reinforces that the skill's public description omits privileged system changes and broader data-handling features. When a skill claims 'every time you choose interactively' but also supports direct targeting, multi-agent operation, and system modification, users may not understand the true execution and privacy/security footprint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill executes external commands (wsl.exe, later clawhub) even though its stated purpose is passive usage-stat viewing. In context, this makes the tool more dangerous because it reaches beyond local parsing into command execution and cross-environment probing without prominent disclosure.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The WSL helper builds executable Python source that embeds a dynamically constructed SQL clause (where) and database path into a python3 -c string. While timestamps are integers, this pattern still mixes code and data unsafely and can become code injection if path values contain quotes or if future changes introduce less constrained inputs.

Content

Scanner excerpt · agent-usage-stats.py (reported line 203)May include surrounding context.

python

"cols={r[1] for r in c.execute('PRAGMA table_info(sessions)')};"
        "has_ac='api_call_count' in cols;has_tc='tool_call_count' in cols;"
        "ac='api_call_count' if has_ac else '0';tc='tool_call_count' if has_tc else '0';"
        "rows=[dict(r) for r in c.execute("
        "f'SELECT model,SUM(input_tokens) inp,SUM(output_tokens) out,SUM(cache_read_tokens) cache,'"
        "f'SUM('+ac+') calls,SUM('+tc+') tools,COUNT(*) cnt FROM sessions%s GROUP BY model')];"
        "sc=c.execute('SELECT COUNT(*) FROM sessions%s').fetchone()[0];"

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · agent-usage-stats.py (reported line 1668)May include surrounding context.

python

calls_expr = "SUM(api_call_count)" if has_api_calls else "0"
            tools_expr = "SUM(tool_call_count)" if has_tool_calls else "0"
            cur = conn.execute(
                f"SELECT model, SUM(input_tokens) as inp, SUM(output_tokens) as out, "
                f"SUM(cache_read_tokens) as cache, {calls_expr} as calls, "
                f"{tools_expr} as tools, COUNT(*) as cnt "

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · agent-usage-stats.py (reported line 1721)May include surrounding context.

python

calls_expr = "SUM(api_call_count)" if has_api_calls else "0"
            tools_expr = "SUM(tool_call_count)" if has_tool_calls else "0"
            cur = conn.execute(
                f"SELECT model, SUM(input_tokens) as inp, SUM(output_tokens) as out, "
                f"SUM(cache_read_tokens) as cache, {calls_expr} as calls, "
                f"{tools_expr} as tools, COUNT(*) as cnt "

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is described as a token-usage viewer, but it also installs wrappers, edits PATH, removes files/configuration, and performs self-updates that copy code into the skill directory. This capability mismatch is dangerous because users may grant trust for read-only analytics while the tool actually changes the execution environment and its own code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that setup automatically adds ~/.local/bin to PATH, but it does not clearly warn that this modifies persistent shell or system configuration files. While this is a common installer behavior, silent persistence-related changes can surprise users and may broaden the trust boundary for anything placed in that directory later.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.en.md (reported line 526)May include surrounding context.

clawhub uninstall ai-agent-usage-stats

text

> `--uninstall` automatically removes the wrapper, cleans the PATH entry, and deletes config files. Works on all platforms.

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill documents persistent PATH modification via setup, including manual instructions to append to ~/.zshrc or ~/.bashrc. Persistent shell initialization changes create execution persistence for the installed wrapper and increase risk if the wrapper or target directory is later replaced or abused.

Content

Scanner excerpt · README.en.md (reported line 606)May include surrounding context.

Cause 2: Ran setup but haven't opened a new terminal → setup writes PATH to system config. Open a new terminal for it to take effect.

Cause 3: setup PATH write failed → Re-run setup and check for errors. If needed, add PATH manually:

macOS (zsh):

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 675)May include surrounding context.

❓ Export says "directory not found"

Cause: the directory path you entered doesn't exist. Create it first:

bash

mkdir -p ~/Desktop/my-data

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states the tool is '不联网、不查 API 后台，纯读本地磁盘文件', which presents a strictly local-only behavior. However, the same document later documents built-in update/install operations (agent-usage-stats update, clawhub install, npm install -g clawhub) that necessarily fetch remote resources, so the stated behavior is broader than 'purely local disk reads.'

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline intent statement says the tool '纯读本地磁盘文件', implying read-only local behavior. Elsewhere, the README documents setup adding ~/.local/bin to PATH, creating wrappers, and --uninstall deleting wrappers/configuration, which actively changes the local system and contradicts the read-only claim.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README frames the skill as a local read-only statistics tool that 'does not connect to the network' and 'purely reads local disk files'. However, the same document later describes operations that write wrapper scripts, modify PATH in shell config/system settings, replace files during update, and delete wrappers/config on uninstall. For a manifest described as selecting an assistant and viewing token consumption, these system-modifying behaviors materially exceed a simple read-only viewer.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented setup modifies PATH and installs a globally accessible wrapper, which is a persistence-like system change beyond merely reading local token-usage files. While this can be legitimate for a CLI utility, it increases blast radius if the tool or future updates are compromised because the command becomes easy to invoke and survives across sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The uninstall flow claims it will delete wrappers, PATH entries, and configuration files automatically, which is broader than necessary for a usage viewer and can remove user data or alter shell configuration unexpectedly. Any automated deletion of config and profile edits is sensitive because mistakes can damage user environments or erase settings without granular confirmation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill metadata declares no explicit tool scope or permissions, yet the documented behavior and static analysis indicate access to environment data, local files, file modification, and shell execution. In a skill ecosystem, this reduces user visibility into what the skill can do and increases the risk of unexpected local access or command execution during setup or operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. The description and user-facing instructions are presented in Chinese only, and the file does not provide an alternative language option or indicate that the skill is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and most CLI help/output strings are written in Chinese, with no mechanism for language selection or indication that the skill is region-specific. This forces a specific language/locale on all users and can violate language-choice policy when no opt-in is provided.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · agent-usage-stats.py (reported line 86)May include surrounding context.

python

# 方式 1：wsl.exe 枚举（最可靠，UNC 目录列表在某些机器上不通）
    try:
        import subprocess
        distros_out = subprocess.run(
            ["wsl.exe", "-l", "-q"],
            stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=5,
        )

Static analysis

No suspicious patterns detected.