Security audit

Usage Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill has a disclosed usage-tracking and billing purpose, but it embeds a billing API key and can perform real payment operations with weak user controls.

Review carefully before installing. This skill can contact SkillPay.me for charges, balances, and payment links, and the published code contains a shared hardcoded billing key. Do not use it with real billing until the key is removed and rotated, transaction amounts are constrained, and charge/recharge actions require clear confirmation and documented data handling.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:11
Finding: Hard-Coded SkillPay Billing API Credential## Vulnerability Details **File Location**: `index.js:11`, with credential use at `index.js:129-141` and additional disclosure at `index.js:218-222` **Vulnerability Type**: Hard-coded secret and exposed billing credential **Risk Level**: High ### Vulnerable Code ```js this.skillPayApiKey = process.env.SKILL_BILLING_API_KEY || 'sk_2842f59e03e64e418c15771b0928c3f94a1f1da73ae7e72adc8f483e9f6fe6b1'; ``` The credential is transmitted to the external billing service as follows: ```js async callSkillPayAPI(endpoint, params) { const BILLING_URL = "https://skillpay.me/api/v1/billing"; const HEADERS = { "X-API-Key": this.skillPayApiKey, "Content-Type": "application/json" }; try { const response = await fetch(BILLING_URL + endpoint, { method: 'POST', headers: HEADERS, body: JSON.stringify(params) }); ``` It is also repeated in setup guidance: ```js return '❌ 请设置 SKILL_BILLING_API_KEY 环境变量:\n' + 'export SKILL_BILLING_API_KEY="sk_2842f59e03e64e418c15771b0928c3f94a1f1da73ae7e72adc8f483e9f6fe6b1"\n' + 'export SKILL_ID="usage-tracker-clawhub"\n' + '@openclaw setup YOUR_API_KEY'; ``` ### Technical Analysis The application uses an embedded credential as the fallback whenever `SKILL_BILLING_API_KEY` is absent. Because source packages are available to every installer, this credential must be treated as publicly disclosed. The key is placed in the `X-API-Key` header for charge, balance, and payment-link requests to `https://skillpay.me/api/v1/billing`. Network access to that service is consistent with the declared billing functionality, so the request itself is not unrelated data exfiltration. However, distributing a shared billing credential exceeds safe minimum-privilege design: every installation receives access associated with the same credential rather than a separately scoped installation credential. Environment-variable support does not m ...[truncated 1672 chars]
Remediation: ## Remediation Suggestions 1. Immediately revoke and rotate the exposed API key. 2. Remove the credential from source code, documentation strings, examples, package history, and published artifacts. 3. Require `SKILL_BILLING_API_KEY` to be supplied through an approved runtime secret store and fail closed when it is missing: ```js this.skillPayApiKey = process.env.SKILL_BILLING_API_KEY; if (!this.skillPayApiKey) { throw new Error('SKILL_BILLING_API_KEY is required'); } ``` 4. Provision separate credentials per installation, tenant, or deployment instead of distributing one shared key. 5. Restrict each credential to only the billing endpoints and operations required by the Skill. 6. Add expiration, rotation, rate limiting, transaction limits, and server-side audit logging. 7. Review billing logs for unauthorized use of the disclosed key. 8. Ensure errors and status output never display the key, including partial values where unnecessary.

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:274
Finding: Unvalidated User-Controlled Financial Transaction Amounts## Vulnerability Details **File Location**: `index.js:274-278` and `index.js:313-315` **Vulnerability Type**: Improper input validation for billing and recharge amounts **Risk Level**: Medium ### Vulnerable Code Charge requests accept a directly parsed command argument: ```js case 'charge': case '计费': case '付款': const feature = args[0] || '使用功能'; const amount = parseFloat(args[1]) || 0.001; const chargeResult = await tracker.chargeUser(user, amount); ``` Recharge requests use the same unsafe pattern: ```js case 'recharge': case '充值': const rechargeAmount = parseFloat(args[0]) || 8; const linkResult = await tracker.getPaymentLink(user, rechargeAmount); ``` The charge value is then sent to the external API without further validation: ```js async chargeUser(userId, amount = 0.001) { if (!this.skillPayApiKey) { return { success: false, error: 'SkillPay.me API Key 未配置' }; } const params = { user_id: userId, skill_id: this.skillId, amount: amount }; const result = await this.callSkillPayAPI('/charge', params); ``` ### Technical Analysis `parseFloat` accepts numeric prefixes and values outside an appropriate financial range. The code does not verify that the amount is finite, positive, within an approved minimum and maximum, expressed with an allowed decimal precision, or equal to the documented price. Consequently, inputs such as negative numbers, extremely large values, or strings with valid numeric prefixes can reach the billing API. JavaScript floating-point numbers are also unsuitable for precise financial calculations unless values are normalized into fixed integer units. The code performs no explicit confirmation before sending a charge request and does not show an authorization check binding `context.user` to the billing account represented by `user_id`. Exploitation ultimately depends on whether SkillPay independently validates amounts and ...[truncated 1711 chars]
Remediation: ## Remediation Suggestions 1. Reject missing or malformed values rather than silently replacing them with a default. 2. Require `Number.isFinite(amount)` and enforce a strictly positive amount. 3. Apply explicit minimum and maximum transaction limits. 4. For fixed-price operations, ignore user-supplied prices and select the amount from a trusted server-side price table. 5. Represent amounts in the smallest integer currency unit rather than binary floating-point values. 6. Restrict decimal precision according to the supported asset. 7. Require explicit user confirmation showing the amount, currency, feature, and target account before charging. 8. Verify that the authenticated caller is authorized to transact against the submitted `user_id`. 9. Duplicate all amount, identity, rate, and authorization checks on the billing server. 10. Add transaction limits, rate limiting, idempotency keys, and auditable transaction records. A defensive validation pattern could be: ```js const rawAmount = args[1]; if (!/^\d+(\.\d{1,4})?$/.test(rawAmount || '')) { return 'Invalid amount'; } const amount = Number(rawAmount); if (!Number.isFinite(amount) || amount < 0.001 || amount > 100) { return 'Amount is outside the permitted range'; } ```

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation indicates billing, balance lookup, and external SkillPay.me integration, but these sensitive behaviors are not clearly and safely declared through permission metadata or prominent security disclosures. Because the skill can trigger financial actions and send data off-platform, incomplete disclosure materially increases the risk of unauthorized charges, data leakage, or operator misunderstanding.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill contains a hardcoded fallback API key and even echoes key material in setup flows, which constitutes embedded secret exposure. Anyone with access to the code or runtime output may recover and abuse the billing credential to query or charge against the external billing service, causing financial loss and account compromise.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The README title and all invocation examples are presented in Chinese, with command words like “跟踪”, “报告”, “统计”, and “查询余额”, but there is no indication that other languages are supported or that Chinese is optional. This can constitute a language-policy issue when a skill implicitly requires a specific language without user opt-in or documented justification.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises usage tracking, personal records, system-wide statistics, data export, and payment setup but does not provide clear warnings about what data is collected, retained, exported, or shared. This is dangerous because users may enable tracking and billing features without informed consent, increasing privacy, compliance, and financial-risk exposure.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to execute `npx clawhub install usage-tracker` without pinning a specific package version. This creates a supply-chain risk because users may fetch whatever version is current at execution time, including a compromised or malicious update, and `npx` executes code directly during installation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The documented commands use broad trigger phrases such as tracking, billing, setup, and balance queries without clear scoping, confirmation requirements, or exclusion conditions. In an agent environment, ambiguous triggers can cause accidental invocation of billing or tracking actions from normal conversation text, leading to unintended data collection or charges.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill advertises capabilities that imply environment-variable access and network use, but it does not declare any explicit tool scope or permissions. This weakens the trust boundary for users and hosting platforms because sensitive operations like API-key handling and external requests may occur without transparent authorization metadata.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The title and main descriptive content are written in Chinese, which effectively imposes a language choice on users reading the skill documentation. The policy allows language constraints only when users are given a choice or when a locale restriction is clearly documented and justified, neither of which appears here.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill promotes paid billing and data export features but does not prominently warn about real charges, exported data sensitivity, retention, or sharing with external services. In a billing-oriented skill, missing user warnings can lead to accidental spending, privacy violations, and uninformed consent around financial and usage data processing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The setup instructions ask users to provide an API key but do not explain secure storage, rotation, scope minimization, or the risk of exposing secrets in command history or shared environments. This can result in credential leakage, especially in agent ecosystems where logs, prompts, or shell histories may be visible to other tools or users.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 74% confidence
Finding: Using `npx clawhub` without a pinned version can cause installation or execution of unexpected code if the upstream package changes or is compromised. In a skill that handles billing setup and API keys, this increases supply-chain risk because a transient package update could capture credentials or alter payment behavior.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Most command labels, help text, status messages, and usage instructions are presented only in Chinese, which imposes a specific language on users. The file does not offer locale selection or document that the skill is intentionally limited to a Chinese-language context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill sends user identifiers, skill identifiers, and payment-related amounts to an external billing API without any explicit consent, notice, or confirmation step. This creates a privacy and transaction-integrity risk because users may be charged or have identifying data disclosed to a third party unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The manifest describes a usage tracking and billing verification tool, which reasonably covers recording usage and checking billing outcomes. However, the code also integrates wallet-style capabilities to query balances and generate recharge/payment links, which are payment operations rather than verification or tracking.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The code reads `SKILL_BILLING_API_KEY` and `SKILL_ID` from environment variables to authenticate with an external billing service, but there is no explanatory warning about credential access or handling. This matches the code-file criterion for sensitive environment variable access lacking disclosure.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The stated purpose suggests tracking usage and verifying billing, typically for a user's own activity or billing records. The getMetrics functionality aggregates total users, total calls, paid calls, and revenue across all tracked users, which introduces broader operational analytics not clearly justified by the manifest description.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:13

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.js:218