ClawHub
Back to skill

Security audit

Token Optimization

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent Markdown guide for reducing OpenClaw token usage, with no hidden code or automatic behavior.

Before applying the guide, review and back up OpenClaw workspace files such as AGENTS.md, MEMORY.md, BOOTSTRAP.md, and openclaw.json. Prefer installing a reviewed release or commit rather than an unpinned latest branch, and confirm the pruning/caching settings fit your workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:37
Finding

Unpinned Third-Party Installation Sources Permit Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 37–44
Vulnerability Type: Unpinned and unverified third-party installation sources
Risk Level: Medium

Vulnerable Code

bash
# From ClawHub
clawhub install token-optimization

# From OpenClaw 水产市场
openclawmp install skill/@Jack-Yang-ai/token-optimization

# From GitHub
git clone https://github.com/Jack-Yang-ai/token-optimization.git

Technical Analysis

Each documented installation method retrieves mutable third-party content without pinning an immutable package version or Git commit. The instructions also provide no checksum, signature, or provenance-verification procedure.

In particular, the git clone command retrieves the repository's current default branch. The resulting files may therefore differ from the version covered by this audit. The marketplace commands similarly omit explicit version constraints and integrity verification.

This creates a supply-chain substitution risk: compromise of a repository, marketplace publisher account, or distribution channel could cause users to install altered Skill instructions or newly introduced executable content. The reviewed project itself contains only Markdown documentation and no malicious scripts; the risk concerns future or substituted upstream content.

Attack Path

  1. An attacker compromises the upstream GitHub account, marketplace publisher account, or relevant distribution channel.
  2. The attacker replaces or updates the mutable package or default branch with malicious Skill instructions or scripts.
  3. A user follows one of the unpinned installation commands in README.md.
  4. The installer retrieves the attacker-controlled current version rather than the content reviewed in this audit.
  5. OpenClaw loads or executes the substituted Skill content under the permissions available to the user's agent environment.

Impact Assessment

The immediate project does not itsel ...[truncated 647 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin marketplace installations to an explicitly reviewed version rather than resolving the latest mutable release.
  2. For GitHub installation, check out an immutable reviewed commit hash or signed release tag after cloning.
  3. Publish SHA-256 checksums or cryptographic signatures for release artifacts and document verification before installation.
  4. Enable signed commits or signed release tags and require users to verify the signer against a trusted identity.
  5. Prefer a trusted registry that provides package immutability, provenance attestations, publisher authentication, and integrity validation.
  6. Document the exact version or commit corresponding to the audited Skill content.
  7. Advise users to inspect package contents and reject unexpected scripts, binaries, lifecycle hooks, or permission requests before enabling the Skill.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to effectively remove BOOTSTRAP.md from normal loading by renaming it, but it does so without any warning to verify the file is truly unnecessary, backed up, or not still required by their environment. In an operational setup, this can cause loss of initialization guidance, break workflows, or make recovery harder if the file contained environment-specific setup steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Line L038 references "OpenClaw 水产市场", introducing a non-English locale-specific label in the skill instructions without any opt-in, translation, or explanation. This can conflict with language/locale policy expectations because the skill documentation partially forces a specific language context on all readers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

Line L141 includes the phrase "海洋大总管" in the author credit. Because the README otherwise targets a general audience and does not explain or localize this phrase, it presents a language/locale policy issue under the requirement to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.