ClawHub
Back to skill

Security audit

IAMMETER

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward IAMMETER API client that needs your IAMMETER token and network access, with minor dependency and CSV-export cautions.

Install this only if you want an OpenClaw agent to access your IAMMETER account data. Use a revocable IAMMETER API token, understand that the skill reads that token from the documented environment/config locations and sends it to IAMMETER, and be cautious opening generated CSV files in spreadsheet software. Dependency pinning and safer CSV serialization would improve the package, but I did not find evidence of deception, persistence, exfiltration beyond the intended API, or destructive behavior.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/cli.js:7
Finding

Unsafe CSV Generation Enables Spreadsheet Formula Injection and Malformed Exports

Content
View full analysis

Vulnerability Details

File Location: scripts/cli.js, lines 7-10
Vulnerability Type: CSV/spreadsheet formula injection and improper CSV encoding
Risk Level: Low

Vulnerable Code

js
function writeCsv(header, rows, out){
  const csv = [header.join(',')].concat(rows.map(r => header.map(h => (r[h]===undefined?'':String(r[h]).replace(/\n/g,' '))).join(','))).join('\n');
  fs.writeFileSync(out, csv);
}

Technical Analysis

The CSV exporter converts API-derived values to strings and concatenates them using commas. It does not perform standards-compliant CSV encoding:

  • Embedded commas are not protected by quoting.
  • Embedded double quotes are not escaped.
  • Carriage returns are not removed or encoded.
  • Cells beginning with spreadsheet formula indicators such as =, +, -, or @ are not neutralized.

Consequently, attacker-controlled or compromised API data can alter the exported CSV structure. When a generated file is opened in spreadsheet software, a formula-leading value may be interpreted as an active formula rather than inert data.

Exploitation requires a malicious or compromised upstream response, or another means of introducing crafted values into fields returned by the IAMMETER API. The audit found no evidence that this project itself manipulates the API response maliciously.

Attack Path

  1. An attacker gains the ability to influence a value returned in IAMMETER energy-history data, such as through a compromised upstream service or account data.
  2. The attacker supplies a value containing CSV delimiters or beginning with a spreadsheet formula marker.
  3. A user runs the history command with the --out option.
  4. writeCsv() inserts the crafted value directly into the CSV without quoting, escaping, or formula neutralization.
  5. The user opens the exported file in spreadsheet software.
  6. The spreadsheet may evaluate the crafted formula or display structurally corrupted data.

Impact Assessment

The issue does n ...[truncated 713 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace manual CSV concatenation with a maintained CSV serialization library that correctly quotes fields and escapes embedded quotes.
  2. If implementing serialization locally:
    • Convert each value to a string.
    • Escape every " as "".
    • Wrap fields containing commas, quotes, carriage returns, or line feeds in double quotes.
  3. Neutralize spreadsheet formulas in untrusted values. For cells beginning with =, +, -, @, tab, or carriage return, prefix the value with an apostrophe or apply another documented formula-injection mitigation suitable for the target spreadsheet application.
  4. Preserve the distinction between raw machine-readable CSV and spreadsheet-safe export modes where data fidelity requirements prohibit altering formula-leading text.
  5. Add tests covering commas, quotes, CR/LF sequences, empty values, Unicode, and formula-leading payloads.
  6. Document that exported API data must be treated as untrusted when opened in spreadsheet software.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
- scripts/iammeter_client.js — Node.js client wrapping common endpoints

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares access to a sensitive environment variable (IAMMETER_TOKEN) in metadata but does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege boundaries and can allow broader-than-necessary runtime access patterns, increasing the chance that secret-bearing code is invoked in contexts not clearly constrained by policy.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range (^1.4.0), which allows newer minor and patch releases to be installed without explicit review. This weakens build reproducibility and can unexpectedly introduce vulnerable or behavior-changing versions through the supply chain.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"test": "node ./scripts/cli.js sitelist"
  },
  "dependencies": {
    "axios": "^1.4.0",
    "yargs": "^17.7.2"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
83% confidence
Finding

Axios has multiple known advisories, and because the manifest does not pin an exact version, it is not possible to verify whether deployed installs avoid affected releases. In an API client skill that makes outbound HTTP requests, an affected axios version could increase risk of SSRF, proxy bypass, request tampering, or other transport-layer issues depending on how the client is used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The yargs dependency is also unpinned via a caret range, so different installs may resolve to different versions over time. This creates supply-chain and reproducibility risk even if no active exploit is evident in this manifest alone.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
},
  "dependencies": {
    "axios": "^1.4.0",
    "yargs": "^17.7.2"
  }
}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill reads a token from both the IAMMETER_TOKEN environment variable and ~/.openclaw/openclaw.json, which is access to sensitive credentials. In this file there is no confirmation prompt, user-facing log, or warning comment/docstring disclosing that credential sources will be read.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The _get method attaches the IAMMETER token to request headers and sends it to https://www.iammeter.com via axios. This is a network operation involving credential transmission, but the file provides no visible disclosure, prompt, or warning to the user about that behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.