ai-quota-check

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:43 AM UTC
• Version: 1.0.1

Overview

The skill provides the promised quota dashboard, but it also reads local authentication/session data and silently makes an authenticated Codex request that can consume quota.

Install only if you are comfortable with the skill reading OpenClaw auth profiles, using provider tokens to query quota APIs, showing account emails in the response, and making a small authenticated Codex request whenever Codex quota is checked. Avoid unattended cron use unless you accept possible quota consumption and session activity.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: index.js:15

Finding

Overbroad Authentication Profile Access and Account Identifier Disclosure

Content

View full analysis

profile.expires : false }; } } return providers; } ``` ```js const providerNames = ['google-antigravity', 'github-copilot', 'openai-codex']; for (const p of providerNames) { const info = loggedIn[p]; if (info) { const status = info.isExpired ? '⚠️ Token Expired' : '✅ Logged In'; console.log(`| ${p} | ${status} | ${info.email || '-'} |`); } else { console.log(`| ${p} | ❌ Not Logged In | - |`); } } ``` ### Technical Analysis The Skill reads and parses the complete shared OpenClaw authentication profile file even though its declared purpose only requires credentials and expiration information for three supported providers. It also returns the complete parsed object through the unused `raw` property, unnecessarily retaining all data from the authentication store. The dashboard includes provider account email addresses in its standard output. `SKILL.md` instructs the invoking Agent to reproduce this o ...[truncated 1715 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: index.js:175

Finding

Implicit Authenticated Codex Request Consumes Quota and Creates Session Activity

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: index.js:153

Finding

Whole Codex Session File Read for Limited Rate-Limit Metadata

Content

View full analysis

= 0; i--) { const line = lines[i].trim(); if (!line) continue; try { const event = JSON.parse(line); const payload = event?.payload; if (payload?.type === 'token_count' && payload?.rate_limits) { return payload.rate_limits; } } catch { // ignore parse errors } } return null; } ``` ```js const latest = findLatestCodexSessionFile(); if (!latest) { results.error = 'No recent Codex session file found'; return results; } const limits = extractCodexRateLimitsFromSession(latest); if (!limits) { results.error = 'No rate_limits found in latest Codex session'; return results; } ``` ### Technical Analysis The Skill reads the entire newest Codex JSONL session into memory to retrieve one `rate_limits` object. Codex session files may contain prompts, responses, source excerpts, filesystem paths, tool activity, and other conversation metadata unrelated to quota monitoring. The current implementation does not print or transmit these session contents. Nevertheless, loading the complete file grants the process access to substantially more sensitive information than required. It also creates a denial-of-service concern if a selected session file is unexpectedly large, because the complete file is synchronously read and then duplicated into an array of lines. The declared quota-monitoring functionality only requires the most recent matching rate-limit event, not the complete conversation history. ### Attack Path 1. The Skill searches `~/.codex/sessions` for recent JSONL files. 2. It selects the newest session file ...[truncated 1144 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is passive quota checking, but the described behavior includes live command execution, reading local auth/session material, and making network requests with stored tokens. That mismatch is dangerous because users may invoke the skill expecting simple reporting while it actually performs privileged actions that can expose credentials, query external services, or trigger side effects.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 91% confidence

Finding

The instruction to display script output exactly as-is creates a direct prompt/output passthrough channel. If the underlying script emits sensitive data, embedded instructions, or adversarial content sourced from provider responses, logs, environment-derived values, or local files, the agent is told not to sanitize or reinterpret it before sending it to the user.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

Unified quota monitor and intelligent model recommender for all providers.

## Output Instructions

**IMPORTANT:** When executing this skill, display the script output **EXACTLY as-is** in markdown format. Do NOT summarize or rephrase the output. The script produces a formatted dashboard that should be shown directly to the user.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The quota-check flow spawns codex exec --skip-git-repo-check "reply OK", which causes a real outbound Codex request as a side effect of merely checking quota status. In this context, a monitoring skill should not silently consume paid usage, contact an external service, or trigger model execution without explicit consent, especially because it may transmit workspace or environment-derived context through the CLI path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes very generic terms such as "quota" and common Korean variants, which can cause the skill to activate in unrelated conversations where a user casually mentions quotas. Because this is marked as a default skill to use first, over-broad invocation increases the chance of unintended execution, misrouting, or disclosure of provider/account quota information when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises executable behavior and environment access via required binaries, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens containment and reviewability, making it easier for a quota-check skill to access environment-derived secrets or runtime capabilities beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger is very broad, telling the agent to use this skill first for generic quota-related requests. In context, that increases risk because a widely auto-invoked skill appears to perform sensitive local-state inspection and external provider interactions, so it may activate in more situations than necessary without clear boundaries or consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest presents this as a default quota checker that users should invoke to view provider quotas. The code additionally embeds task-specific routing rules and later emits prescriptive model recommendations, which is a broader decision-making function than simple quota inspection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 124)May include surrounding context.

js

};

  try {
    const data = await fetchJson('https://api.github.com/copilot_internal/user', headers, null, 'GET');
    const premium = data.quota_snapshots?.premium_interactions;
    
    if (premium) {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The subprocess invocation triggers a live Codex request with no user-facing disclosure or confirmation. In a quota-checking skill, hidden side effects are especially risky because users reasonably expect read-only behavior; instead, this can silently spend quota, generate logs/session artifacts, and create unintended external traffic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The comments suggest the implementation is not calling a quota endpoint, but the code still forces a live Codex request before reading limits. That mismatch is dangerous because it obscures the true behavior of the skill, undermines informed consent, and makes reviewers or users more likely to trust a flow that actually performs networked side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The script loads auth-profiles.json from the user's home directory and processes provider account details such as email, expiry, and tokens, but there is no user-facing warning that sensitive local authentication metadata is being accessed. Developer comments and variable names are present, but the criteria require some form of disclosure to the user for sensitive credential access.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:205