ClawHub
Back to skill

Security audit

Balance Checker

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real AI API balance checker, but it deserves review because it can use local API credentials automatically and its install steps rely on mutable, unpinned external code.

Review this before installing if you keep API keys in OpenClaw config. Prefer the reviewed ClawHub install path over cloning a mutable GitHub branch, use least-privilege provider credentials where available, and be aware that invoking the skill may send authenticated requests to the configured providers and print account balances into the current chat.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
setup_volcengine.sh:41
Finding

Unpinned Python Dependencies Permit Supply-Chain Code Execution

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:39
Finding

Installation Instructions Retrieve Skill Code from an Unpinned Repository Branch

Content
View full analysis
Remediation
View remediation
git verify-commit cp -r balance-checker ~/.openclaw/skills/ ``` 5. Review the checked-out Skill files before copying or executing them. 6. Avoid reusing a predictable temporary destination without confirming its ownership and contents; use a newly created directory from `mktemp -d` and remove it after installation. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description presents itself as a generic balance checker, but the visible setup and resource access are focused on Volcengine installation and AK/SK credential use. This creates a trust and transparency problem: users may not realize that the skill requires cloud access keys and setup steps beyond a simple balance query, increasing the risk of over-privileged credential exposure.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill description presents itself as a generic balance checker, but the visible setup and resource access are focused on Volcengine installation and AK/SK credential use. This creates a trust and transparency problem: users may not realize that the skill requires cloud access keys and setup steps beyond a simple balance query, increasing the risk of over-privileged credential exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented trigger phrases are very broad everyday-language expressions like '查余额', '余额多少', and '还有多少额度', which can easily appear in normal conversation and unintentionally auto-trigger the skill. In this skill’s context, accidental activation could cause unsolicited external API calls and exposure of sensitive account balance information to the current chat/session, making it a genuine security and privacy concern even without malicious code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises access to environment variables, file reads, and shell execution but does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the blast radius of accidental or unauthorized actions, especially because the skill handles API credentials and instructs users to run shell commands during setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad everyday expressions such as '查余额' and '余额多少', which can cause the skill to auto-run in contexts the user did not intend. Because the skill may access credentials, perform network requests, or invoke setup-related behavior, misfires can lead to unnecessary exposure of sensitive account information or unintended command execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The listed keywords are ambiguous and lack scoping or exclusion conditions, making accidental activation more likely. In the context of a skill that reads environment-provided API keys and may execute supporting scripts, ambiguous triggering materially raises the chance of unintended sensitive operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · check_balance.sh (reported line 14)May include surrounding context.

sh
if [ -n "$DEEPSEEK_API_KEY" ]; then
    echo ""
    echo "💰 DeepSeek 余额"
    DEEPSEEK_RESULT=$(curl -s "https://api.deepseek.com/user/balance" \
        -H "Authorization: Bearer $DEEPSEEK_API_KEY" \
        -H "Content-Type: application/json" 2>/dev/null)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · check_balance.sh (reported line 45)May include surrounding context.

sh
if [ -n "$MOONSHOT_API_KEY" ]; then
    echo ""
    echo "🌙 Moonshot/Kimi 余额"
    MOONSHOT_RESULT=$(curl -s "https://api.moonshot.cn/v1/users/me/balance" \
        -H "Authorization: Bearer $MOONSHOT_API_KEY" 2>/dev/null)
    
    if echo "$MOONSHOT_RESULT" | grep -q "available_balance"; then

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the skill checks balances for multiple AI API providers including DeepSeek, Moonshot/Kimi, and Volcengine, but this file only retrieves Volcengine credentials and calls the Volcengine billing SDK. That is a direct scope mismatch between the advertised capability and the actual implemented behavior in this skill file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The user-facing instructions, examples, and trigger phrases are presented entirely in Chinese, which can amount to a language policy issue if the skill implicitly assumes a specific language without user opt-in. There is no note that the skill is Chinese-only, region-specific, or that alternative languages are supported.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This shell script performs outbound HTTP requests using bearer credentials from environment variables to retrieve account balance information, but it does not include any user-facing warning that it will contact external provider APIs and transmit authentication data. Although the operation is central to the script's purpose, the code provides only progress messages and no explicit disclosure about network access or credential use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script checks for sensitive access key and secret key environment variables, activates a virtual environment, and runs a Python helper that will use those credentials, but there is no explicit disclosure to the user that these secrets are being consumed for an authenticated external balance check. The visible messages mention querying balance and dependencies, but not sensitive credential usage or subprocess execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains user-facing natural language in Chinese in the module docstring and throughout CLI output, but does not provide an opt-in, alternative locale, or justification for enforcing a single language. That can violate language/locale policy when users are not explicitly limited to a Chinese-language environment.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · query_balance.py (reported line 101)May include surrounding context.

python
def get_val(obj, key):
        if isinstance(obj, dict):
            return obj.get(key)
        return getattr(obj, key, None)
    
    if quiet:
        # 简洁输出，适合嵌入到 balance-checker

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Nearly all user-facing messages in the script are written only in Chinese, including installation guidance and credential setup instructions. This can violate language/locale policy expectations when a skill forces a specific language without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.