Daily Cost Report

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

This cost-reporting skill is coherent, but it needs review because it handles broad usage metadata, can email it externally, and stores reports insecurely in predictable /tmp files.

Review before installing. Use local-only report generation unless email recipients are trusted and explicitly configured; avoid running this as a privileged scheduled job; store reports in a private user-owned directory with restrictive permissions; and remove the unused OPENAI_API_KEY requirement before deployment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily-cost-report.sh:31

Finding

Predictable temporary files allow local disclosure and symlink attacks

Content

View full analysis

"$OUTPUT_FILE" < "$HTML_FILE" << EOF ``` The fallback delivery path is also predictable: ```bash cp "$HTML_FILE" "/tmp/cost-report-${DATE_STR}-UNSENT.html" ``` ### Technical Analysis The scripts create and overwrite files under the shared `/tmp` directory using filenames derived from a predictable report date. The temporary working directory is based on the process ID, which is also guessable. The scripts do not: - Use `mktemp` for unpredictable, exclusive creation. - Apply a restrictive `umask`. - Verify that paths are regular files rather than symbolic links. - Refuse to overwrite existing files. - Create report files inside a private directory. - Atomically publish completed reports. Shell redirection and `cp` normally follow symbolic links. A local user who can write to `/tmp` can therefore pre-create one of the expected paths as a symbolic link. When the report runs under a more privileged or different account, it may overwrite the symlink target with the privileges of that account. The generated reports also contain potentially sensitive operational metadata, including session keys, agent identifiers, model usage, channel names, token counts, and costs. Depending on the account's `umask`, another local user may be able to read these fi ...[truncated 1185 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily-cost-report-email.sh:167

Finding

Unescaped session metadata is embedded in an HTML email

Content

View full analysis

> "$OUTPUT_FILE" done < "$TEMP_DIR/top_sessions.txt" ``` The complete report is then inserted directly into an HTML document: ```html

text

$(cat "$REPORT_FILE")

``` ### Technical Analysis The report includes values originating in OpenClaw session metadata, including session keys, agent IDs, model names, and channel names. These values are not HTML-escaped before the Markdown file is interpolated into the HTML email. An HTML `

text

` element only controls formatting; it does not cause its contents to be treated as plain text. A value containing markup such as `

` can terminate the element and introduce arbitrary HTML into the message. Most email clients block or restrict JavaScript, so reliable script execution should not be assumed. However, HTML injection can still be used for: - Visual content spoofing. - Inserting misleading links or instructions. - Adding externally hosted images that act as tracking requests. - Concealing or altering the apparent report layout. - Displaying attacker-controlled content as part of a trusted automated report. ### Attack Path 1. An attacker obtains a way to influence an agent identifier, session key, model label, or another field included in OpenClaw session metadata. 2. The attacker supplies a value containing HTML, for example a closing `` tag followed by an external image or misleading link. 3. `daily-cost-r ...[truncated 926 chars]

Remediation

View remediation

` as `>` - `"` as `"` - `'` as `'` For example, use a dedicated escaping function or a well-maintained templating tool rather than direct command substitution. Alternatively, convert Markdown with a trusted renderer configured to: - Strip raw HTML. - Reject unsafe URL schemes. - Disable embedded remote content where possible. - Sanitize the generated HTML against an allowlist. Avoid interpolating `$(cat "$REPORT_FILE")` directly into an HTML heredoc. Treat every session-derived field as untrusted, even when it normally comes from a local CLI. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send-cost-report.sh:40

Finding

Unvalidated recipient input permits email header and mail-option injection

Content

View full analysis

" echo "To: $RECIPIENT" echo "Subject: 🐈‍⬛ OpenClaw Cost Report - $PRETTY_DATE ($TOTAL_COST)" echo "MIME-Version: 1.0" echo "Content-Type: text/html; charset=UTF-8" echo "Content-Transfer-Encoding: 8bit" echo "" # Email body (HTML) cat "$HTML_FILE" } | mail -t -v "$RECIPIENT" 2>/dev/null || { ``` ### Technical Analysis Shell quoting prevents ordinary shell metacharacters inside `RECIPIENT` from being interpreted by the shell, but it does not make the value safe for other parsers. The recipient is inserted into a mail header without rejecting carriage returns or newline characters. If an attacker can provide an argument containing a line break, the generated message can contain additional attacker-selected headers, such as `Bcc`, `Cc`, or `Reply-To`. The same value is also passed to the platform-dependent `mail` command. A recipient beginning with `-` may be interpreted as an option by some implementations because no `--` end-of-options delimiter or strict validation is used. Exact consequences vary among BSD Mail, GNU Mailutils, and other `mail` implementations. The report contains metadata for all agents, making unauthorized redirection a confidentiality concern. ### Attack Path 1. An attacker gains control over the recipient argument passed to `send-cost-report.sh`, directly or through an automation layer. 2. The attacker supplies a recipient containing a newline followed by an additional mail header, such as an unauthorized `Bcc` destination. 3. The script writes the supplied value directly after `To:`. 4. Because `mail -t` parses recip ...[truncated 984 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:6

Finding

Skill unnecessarily requires access to an OpenAI API credential

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

---

name: daily-cost-report description: Generate daily OpenClaw cost reports with breakdown by agent/model/channel. Use when: daily cron job, on-demand cost analysis, cost auditing. Generates HTML-formatted email reports. emoji: 📊 requires: env: - OPENAI_API_KEY

Daily Cost Report 📊

Generate comprehensive OpenClaw usage and cost reports with breakdowns by agent, model, and channel. Supports both on-demand analysis and automated daily email delivery.

Quick Start

bash

# Generate report for yesterday (markdown)
{baseDir}/scripts/daily-cost-report.sh yesterday

# Generate report for a specific dat

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

### `daily-cost-report.sh`

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

Example Output

text

# OpenClaw Daily Cost Report 🐈‍⬛
**Date:** 2026-03-18  
**Generated:** 2026-03-19 08:00:00 PDT

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly supports emailing usage and cost reports, which may include sensitive operational metadata such as agent activity, channels, and high-cost sessions, but it does not warn users that this data leaves the local environment. In this context, the omission increases the risk of unintentional data exfiltration to external recipients through routine or automated use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script writes session-derived usage metadata, including session keys, agent IDs, models, channels, token counts, and costs, to a predictable file in /tmp. On multi-user systems, /tmp is world-accessible and the report filename is guessable, which can expose potentially sensitive operational or tenant data to other local users or processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L147 states "No external API calls" and frames the skill as costing nothing because it only reads tracked metadata. However, elsewhere the same file documents a send-cost-report script that emails reports to recipients, which is an external side effect beyond purely local report generation. This is an intent/documentation contradiction, even if it does not necessarily involve a paid API.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The top-level comment describes the script as sending a daily cost report via email. However, when the mail command fails, the code at L49-L53 does not send anything and instead copies the report to /tmp as an unsent file, which contradicts the stated behavior rather than merely omitting an implementation detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.