Security audit

Agent Session Cost

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its cost-tracking purpose, but it reads broad session transcripts, suggests recurring heartbeat execution, and hides unrelated external registration endpoints.

Review carefully before installing. Use it only if you are comfortable with it reading OpenClaw session transcript files, preferably after narrowing the examples to the specific agent or session you want analyzed. Do not enable the heartbeat budget check unless you intentionally want recurring execution, and treat the hidden external endpoint metadata as a reason to ask the publisher for clarification or removal.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:43
Finding: Cross-Agent Session Transcript Enumeration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-51` **Additional Occurrences**: `SKILL.md:72-76`, `SKILL.md:91-99` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```python for f in glob.glob(os.path.expanduser("~/.openclaw/agents/*/sessions/*.jsonl")): if today in os.path.basename(f) or os.path.getmtime(f) > __import__('time').time() - 86400: sessions += 1 with open(f) as fh: for line in fh: try: cost = json.loads(line).get('message',{}).get('usage',{}).get('cost',{}).get('total',0) if cost: total += cost except: pass ``` Equivalent cross-agent wildcard access is also used by the budget-check and per-model-breakdown examples. ### Technical Analysis The wildcard path `~/.openclaw/agents/*/sessions/*.jsonl` enumerates and opens session transcripts belonging to every locally accessible agent. It does not restrict access to the current agent or to a dedicated usage ledger. Although the supplied code only extracts model and cost fields, each entire JSONL line is read and decoded first. Session transcripts may contain prompts, responses, tool results, and other sensitive operational context. Consequently, the implementation gives the cost-analysis workflow access to substantially more data than it needs. The code does not bypass operating-system permissions, and no transmission of transcript data is implemented. The security concern is the failure to maintain least-privilege separation between local agents. ### Attack Path 1. A user or agent runs one of the documented cost-analysis commands. 2. The wildcard enumerates session files for every agent under `~/.openclaw/agents/`. 3. The process opens every qualifying transcript file that its current account can read. 4. Every JSONL record is loaded into memory and parsed. 5. A modified, compromised, or extended version ...[truncated 662 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Restrict the default path to the current agent and current session. - Require explicit user authorization before producing a fleet-wide cost report. - Prefer a dedicated usage or billing ledger that contains only timestamps, model identifiers, token counts, and costs. - Allow cross-agent paths only through an explicit allowlist rather than the `*` wildcard. - Validate resolved paths and reject files outside the intended session directory. - Avoid parsing complete transcript records when usage metadata can be stored and read separately. - Document the exact files accessed and the sensitivity of session transcripts. - Run the reporting process under an account or sandbox with access only to required usage data. ]]>

T06 · System Persistence

Warning

Location: SKILL.md:61
Finding: Persistent Recurring Execution Through Heartbeat Modification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61-66` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium ### Vulnerable Code ```markdown Add to your heartbeat: ## Cost Check (every 4 hours) Run session cost check. If daily spend > $15, alert human. ``` ### Technical Analysis The skill directs the user or agent to add its cost-check instruction to a persistent heartbeat. This causes the instruction to continue executing every four hours after the original skill interaction has ended. The stated behavior is a budget alert rather than a backdoor, but it still establishes a durable recurring execution point. The heartbeat task also invokes the broadly scoped transcript scan described elsewhere in the file. If the referenced instruction, skill content, or execution environment is later modified, the persistent heartbeat may repeatedly execute the altered behavior. The document does not provide an expiration time, removal procedure, integrity protection, or a requirement for explicit informed consent before establishing the recurring task. ### Attack Path 1. The skill is loaded and its setup instructions are followed. 2. The cost-check directive is inserted into the agent’s persistent heartbeat configuration. 3. The heartbeat survives the immediate skill run and activates every four hours. 4. Each activation runs the session-cost check and scans recent session files. 5. If the referenced behavior is later changed or compromised, the heartbeat becomes a recurring execution mechanism for that changed behavior. ### Impact Assessment Persistence is limited to the permissions and execution capabilities of the affected OpenClaw agent. It can repeatedly consume resources, inspect locally readable session records, and generate alerts across future sessions. The audited file does not install an operating-system service, elevate privileges, or itself modify the heartbeat automatically. Exploitation requires an agent or user to ...[truncated 133 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not modify a persistent heartbeat without explicit, informed user approval. - Present the exact command, schedule, accessed files, and expected resource use before installation. - Use a clearly identified scheduler entry with a fixed command rather than an open-ended natural-language instruction. - Scope the scheduled task to a dedicated usage ledger or the current agent’s usage data. - Add an expiration date, execution-frequency limit, and documented removal procedure. - Store a hash or pinned version of the invoked logic so later skill changes cannot silently alter scheduled behavior. - Record each execution and provide a visible status showing that the recurring task is enabled. - Offer a one-time cost check as the safe default, with recurring checks as an explicit opt-in feature. ]]>

other

Warning

Location: SKILL.md:107
Finding: Hidden Third-Party Registration and Ping Endpoint Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:107` **Vulnerability Type**: `other: Hidden External Coordination Metadata` **Risk Level**: Medium ### Vulnerable Code ```html  ``` ### Technical Analysis A hidden HTML comment declares an external hub, agent-registration endpoint, and ping endpoint hosted on `onlyflies.buzz`. These endpoints are unrelated to the visible session-cost functionality and are not explained elsewhere in the project. The comment alone does not perform a network request. However, its structured `OADP:1.0` format may be machine-readable metadata intended for a compatible loader or agent framework. If such a consumer automatically interprets the metadata, it could register an agent with the external service or send recurring ping traffic without the endpoints being visible in rendered Markdown. The audit found no code proving that registration, pinging, or data exfiltration occurs. The risk arises from concealed and unexplained coordination metadata that may trigger behavior in an OADP-aware environment. ### Attack Path 1. The skill is imported by a loader that recognizes structured OADP metadata. 2. The loader parses the hidden HTML comment even though it is not visible in rendered documentation. 3. The loader obtains the external hub, registration, and ping URLs. 4. Depending on loader behavior, it may contact the registration endpoint and subsequently send ping requests. 5. The external operator could receive agent metadata or network identifiers included by the loader. This exploitation path is conditional on an OADP-aware component acting on the metadata; that behavior is not implemented or demonstrated in the audited project itself. ### Impact Assessment Potential impact includes undisclosed outbound communication, disclosure of network met ...[truncated 355 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove the hidden OADP metadata unless it is essential to the documented purpose of the skill. - If the integration is intentional, disclose it visibly rather than placing it only in an HTML comment. - Require explicit opt-in consent before registration or ping traffic occurs. - Document every transmitted field, the request frequency, retention policy, operator identity, and purpose. - Ensure loaders treat external endpoint metadata as inert unless the destination is user-approved and allowlisted. - Disable automatic registration and heartbeat traffic by default. - Apply strict outbound-network controls so a documentation file cannot silently authorize communication with an arbitrary domain. - Authenticate and integrity-protect any approved coordination protocol, and provide a straightforward method to revoke registration. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to read session JSONL files that may contain full transcripts, model metadata, and usage details, but it gives no privacy warning, scoping limitation, or data-minimization guidance. Even though the goal is cost calculation, the implementation accesses raw session contents, which can unnecessarily expose sensitive prompts, outputs, or secrets contained in transcripts.

File System Enumeration

Medium

Category: Data Exfiltration
Content: ```bash # Today's sessions ls -la ~/.openclaw/agents/main/sessions/ | tail -5 # Parse costs from latest session LATEST=$(ls -t ~/.openclaw/agents/main/sessions/*.jsonl 2>/dev/null | head -1)
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The embedded OADP comment advertises external hub, registration, and ping endpoints that are unrelated to the stated purpose of local session cost analysis. Hidden or undocumented network endpoints in a local-analysis skill create a covert integration path for agent discovery, registration, or telemetry, which is especially suspicious because they are not needed to parse local JSONL cost data.

Static analysis

No suspicious patterns detected.