Openrouter Usage

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:36 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it says, but its installer can silently delete an existing OpenClaw skill directory when linking the skill.

Review before installing. The runtime behavior is consistent with a spending tracker, but run install.sh carefully: accepting the default skill-link prompt may delete an existing ~/.openclaw/workspace/skills/openrouter-usage directory. Prefer backing up that path first or manually creating the symlink. Also be aware the tool reads OpenClaw session logs and may read OpenRouter credentials from the OpenClaw auth store.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:62

Finding

Unsafe Recursive Deletion of an Existing Skill Directory

Content

View full analysis

Vulnerability Details

File Location: install.sh, lines 62–66
Vulnerability Type: Unsafe recursive deletion during installation
Risk Level: Medium

bash

LINK_TARGET="${SKILL_DIR}/${BIN_NAME}"

if [ -L "${LINK_TARGET}" ] || [ -d "${LINK_TARGET}" ]; then
    rm -rf "${LINK_TARGET}"
fi

Technical Analysis

The installer deletes an existing path at ~/.openclaw/workspace/skills/openrouter-usage before creating the Skill symlink. The condition permits both symbolic links and real directories, while rm -rf recursively removes either without distinguishing between them.

Although the user is asked whether to link the Skill, the prompt does not disclose that accepting the default action may permanently erase an existing directory and all files beneath it. Recursive deletion of a real directory is not necessary to replace an existing symbolic link and violates safe installation practices.

The destination is constructed from fixed variables, so the reviewed code does not expose direct shell command injection. Nevertheless, any pre-existing data at the fixed destination can be destroyed with the permissions of the user running the installer.

Attack Path

1. A real directory exists at ~/.openclaw/workspace/skills/openrouter-usage.
2. The directory contains an existing Skill installation, local modifications, or other user-created files.
3. The user runs install.sh.
4. The installer asks whether to link the project as an OpenClaw workspace Skill, defaulting to Y.
5. The user accepts the prompt without being warned that existing content will be recursively deleted.
6. The rm -rf "${LINK_TARGET}" command permanently removes the existing directory tree.
7. The deleted directory is replaced with a symbolic link to the current project.

Impact Assessment

Exploitation does not grant additional privileges or code execution beyond those already held by the installer process. Its primary im ...[truncated 413 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat symbolic links and real directories separately.
2. Remove an existing symbolic link with non-recursive rm -- "${LINK_TARGET}".
3. Refuse to overwrite a real directory by default.
4. If directory replacement is required, display the exact path and require a separate explicit confirmation.
5. Back up or rename an existing directory instead of permanently deleting it.
6. Validate that the destination remains the expected direct child of ${SKILL_DIR} before modifying it.
7. Use ln -s only after confirming that the destination no longer exists.

A safer implementation would resemble:

bash

if [ -L "${LINK_TARGET}" ]; then
    rm -- "${LINK_TARGET}"
elif [ -e "${LINK_TARGET}" ]; then
    echo -e "${RED}Error: Refusing to overwrite existing path: ${LINK_TARGET}${NC}"
    echo "Move or back up that path, then rerun the installer."
    exit 1
fi

ln -s -- "${SCRIPT_DIR}" "${LINK_TARGET}"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

text

The installer will:
1. Create a `openrouter-usage` CLI wrapper in `~/.local/bin/`
2. Optionally link it as an OpenClaw workspace skill
3. Warn you if `~/.local/bin` isn't in your PATH

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises behavior that requires sensitive capabilities—reading local session files, accessing environment/auth material for an API key, invoking a local binary, and likely making network requests—but it does not declare any tool scope or permission boundaries. This creates an over-privileged, opaque execution model where an agent may use broader file, env, shell, or network access than a reviewer or user expects, increasing the risk of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 32)May include surrounding context.

sh

# Ensure script is executable
chmod +x "${SCRIPT_PATH}"

# ── 1. Create CLI wrapper ────────────────────────────────────────────────────

mkdir -p "${BIN_DIR}"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a usage/spending tracker for OpenRouter credits and session-log cost analysis. While querying the OpenRouter API is expected, the implementation also searches local OpenClaw auth stores and reads credential material from auth.json files, which is a broader credential-access capability than the stated analytics purpose implies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script silently falls back to reading credentials from local OpenClaw auth files without explicit user-facing disclosure at runtime. While this is not credential theft by itself, implicit access to stored secrets can violate user expectations and increase the chance that operators run the tool without realizing it will inspect secret-bearing files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.