Agent Session Cost

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its cost-tracking purpose, but it reads broad session transcripts, suggests recurring heartbeat execution, and hides unrelated external registration endpoints.

Review carefully before installing. Use it only if you are comfortable with it reading OpenClaw session transcript files, preferably after narrowing the examples to the specific agent or session you want analyzed. Do not enable the heartbeat budget check unless you intentionally want recurring execution, and treat the hidden external endpoint metadata as a reason to ask the publisher for clarification or removal.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:43

Finding

Cross-Agent Session Transcript Enumeration

Content

View full analysis

__import__('time').time() - 86400: sessions += 1 with open(f) as fh: for line in fh: try: cost = json.loads(line).get('message',{}).get('usage',{}).get('cost',{}).get('total',0) if cost: total += cost except: pass ``` Equivalent cross-agent wildcard access is also used by the budget-check and per-model-breakdown examples. ### Technical Analysis The wildcard path `~/.openclaw/agents/*/sessions/*.jsonl` enumerates and opens session transcripts belonging to every locally accessible agent. It does not restrict access to the current agent or to a dedicated usage ledger. Although the supplied code only extracts model and cost fields, each entire JSONL line is read and decoded first. Session transcripts may contain prompts, responses, tool results, and other sensitive operational context. Consequently, the implementation gives the cost-analysis workflow access to substantially more data than it needs. The code does not bypass operating-system permissions, and no transmission of transcript data is implemented. The security concern is the failure to maintain least-privilege separation between local agents. ### Attack Path 1. A user or agent runs one of the documented cost-analysis commands. 2. The wildcard enumerates session files for every agent under `~/.openclaw/agents/`. 3. The process opens every qualifying transcript file that its current account can read. 4. Every JSONL record is loaded into memory and parsed. 5. A modified, compromised, or extended version ...[truncated 662 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SKILL.md:61

Finding

Persistent Recurring Execution Through Heartbeat Modification

Content

View full analysis

$15, alert human. ``` ### Technical Analysis The skill directs the user or agent to add its cost-check instruction to a persistent heartbeat. This causes the instruction to continue executing every four hours after the original skill interaction has ended. The stated behavior is a budget alert rather than a backdoor, but it still establishes a durable recurring execution point. The heartbeat task also invokes the broadly scoped transcript scan described elsewhere in the file. If the referenced instruction, skill content, or execution environment is later modified, the persistent heartbeat may repeatedly execute the altered behavior. The document does not provide an expiration time, removal procedure, integrity protection, or a requirement for explicit informed consent before establishing the recurring task. ### Attack Path 1. The skill is loaded and its setup instructions are followed. 2. The cost-check directive is inserted into the agent’s persistent heartbeat configuration. 3. The heartbeat survives the immediate skill run and activates every four hours. 4. Each activation runs the session-cost check and scans recent session files. 5. If the referenced behavior is later changed or compromised, the heartbeat becomes a recurring execution mechanism for that changed behavior. ### Impact Assessment Persistence is limited to the permissions and execution capabilities of the affected OpenClaw agent. It can repeatedly consume resources, inspect locally readable session records, and generate alerts across future sessions. The audited file does not install an operating-system service, elevate privileges, or itself modify the heartbeat automatically. Exploitation requires an agent or user to ...[truncated 133 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:107

Finding

Hidden Third-Party Registration and Ping Endpoint Metadata

Content

View full analysis

``` ### Technical Analysis A hidden HTML comment declares an external hub, agent-registration endpoint, and ping endpoint hosted on `onlyflies.buzz`. These endpoints are unrelated to the visible session-cost functionality and are not explained elsewhere in the project. The comment alone does not perform a network request. However, its structured `OADP:1.0` format may be machine-readable metadata intended for a compatible loader or agent framework. If such a consumer automatically interprets the metadata, it could register an agent with the external service or send recurring ping traffic without the endpoints being visible in rendered Markdown. The audit found no code proving that registration, pinging, or data exfiltration occurs. The risk arises from concealed and unexplained coordination metadata that may trigger behavior in an OADP-aware environment. ### Attack Path 1. The skill is imported by a loader that recognizes structured OADP metadata. 2. The loader parses the hidden HTML comment even though it is not visible in rendered documentation. 3. The loader obtains the external hub, registration, and ping URLs. 4. Depending on loader behavior, it may contact the registration endpoint and subsequently send ping requests. 5. The external operator could receive agent metadata or network identifiers included by the loader. This exploitation path is conditional on an OADP-aware component acting on the metadata; that behavior is not implemented or demonstrated in the audited project itself. ### Impact Assessment Potential impact includes undisclosed outbound communication, disclosure of network met ...[truncated 355 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to read session JSONL files that may contain full transcripts, model metadata, and usage details, but it gives no privacy warning, scoping limitation, or data-minimization guidance. Even though the goal is cost calculation, the implementation accesses raw session contents, which can unnecessarily expose sensitive prompts, outputs, or secrets contained in transcripts.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

bash

# Today's sessions
ls -la ~/.openclaw/agents/main/sessions/ | tail -5

# Parse costs from latest session
LATEST=$(ls -t ~/.openclaw/agents/main/sessions/*.jsonl 2>/dev/null | head -1)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The embedded OADP comment advertises external hub, registration, and ping endpoints that are unrelated to the stated purpose of local session cost analysis. Hidden or undocumented network endpoints in a local-analysis skill create a covert integration path for agent discovery, registration, or telemetry, which is especially suspicious because they are not needed to parse local JSONL cost data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.