LLM Cost Tracker

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:53 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent API cost tracker that uses provider credentials and local files in ways that fit its stated purpose, with some privacy considerations users should understand.

Install this only if you want an agent to inspect API spending data. Before running provider-backed summaries, confirm you are comfortable with it using environment API keys and querying provider usage APIs. Review or delete ~/.openclaw/cost-tracker.json and ~/.openclaw/cost-data if you do not want local budget and usage history retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

return []
        url = f"https://api.openai.com/v1/usage?start_date={start.strftime('%Y-%m-%d')}&end_date={end.strftime('%Y-%m-%d')}"
        req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}"})
        with urllib.request.urlopen(req, timeout=10) as resp:
            data = json.loads(resp.read())
        results = []
        for entry in data.get("data", []):

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and likely relies on sensitive capabilities including environment variable access, local file read/write, and network calls, but it does not declare any tool scope or permissions boundaries. This creates an authorization ambiguity where an agent may invoke the skill without clearly signaling that it will access API keys, local config, billing data, and external provider endpoints.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation text is broad enough to trigger on common cost, billing, or token-usage questions, which can cause the agent to invoke this skill in situations where the user only wanted general advice. In this skill's context, overbroad activation is risky because the skill may access provider usage data and local budget configuration rather than staying purely conversational.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes reading provider usage/billing information and configuring alerts in a local file, but it does not warn users that account data, API-backed billing details, and local configuration under ~/.openclaw may be accessed or modified. Lack of transparency can lead to unexpected disclosure of spending patterns or unintended changes to monitoring and alert behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

key = os.environ.get("OPENAI_API_KEY", "")
        if not key:
            return []
        url = f"https://api.openai.com/v1/usage?start_date={start.strftime('%Y-%m-%d')}&end_date={end.strftime('%Y-%m-%d')}"
        req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}"})
        with urllib.request.urlopen(req, timeout=10) as resp:
            data = json.loads(resp.read())

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script persistently stores API usage metadata and budget information under ~/.openclaw without any notice, consent flow, retention policy, or permission hardening. While it does not store API keys, usage logs can still reveal provider choices, model names, timestamps, and spending patterns that may be sensitive on shared systems or in regulated environments.

Static analysis

No suspicious patterns detected.