T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/token-audit.py:72- Finding
Overbroad Access to Sensitive Agent State and Unselected Workspace Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Token Audit
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate token-cost audit tool, but it reads sensitive OpenClaw workspace state and also scans the default global skills directory even when a specific workspace is selected.
Install only if you are comfortable with a local script reading OpenClaw core files, memory files, and installed skill source to compute token counts. Run it in a workspace without sensitive memory if possible, avoid sharing JSON output publicly because it may contain absolute paths, and treat its model coverage claims as incomplete.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code broadly matches the declared theme: it is a workspace token/cost analyzer for OpenClaw that scans files, estimates token usage, and produces cost and optimization guidance without using API keys. However, there are material description-to-behavior gaps. Most importantly, the advertised multi-model coverage is overstated: the implemented pricing/comparison set does not include Gemini, Llama, Mistral, or Qwen, and instead includes DeepSeek models not mentioned in the description. Also, the claimed ability to identify redundant files is not actually implemented as a detection feature; the script only infers possible overlap from aggregate core token size. Finally, the 'zero dependencies' claim is not fully accurate because the script optionally depends on tiktoken for accurate counting. These are substantive enough to count as a mismatch, though the primary purpose remains aligned.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest says the skill estimates token counts across GPT-4, Claude, Gemini, Llama, Mistral, and Qwen, but the code only defines pricing for Claude, GPT-4o, and DeepSeek variants. The report's cross-model comparison likewise omits Gemini, Llama, Mistral, and Qwen, so the actual behavior does not match the advertised scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The tool reads multiple core files, memory files, and skill files across the workspace to estimate token usage. While scanning is central to the tool's purpose, the current usage text does not explicitly warn users that file contents across these directories will be read, which is relevant for privacy-sensitive workspaces.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script collects absolute paths for workspace files and later includes them in JSON output, which can disclose local filesystem structure. Although this is not destructive, it is a user/system data exposure operation and the file does not provide an explicit warning in output, prompt, or comments about exporting those paths.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The comment states 'Only count files the agent actually loads (SKILL.md + direct scripts)', which implies a limited subset. However, the implementation traverses all files under each skill directory matching several extensions, including markdown, JSON, and source files beyond direct scripts, so the documentation overstates selectivity.
- Content