ClawHub
Back to skill

Security audit

Claude Usage

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently calculates Claude usage from local OpenClaw session logs, with manageable privacy and install-supply-chain cautions.

Install only from a source you trust, preferably with a pinned ClawHub/package version. Expect the tool to read local OpenClaw or Moltbot session logs and print usage summaries, including session identifiers and token counts; use `--sessions-dir` if you want to limit what it scans.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Unpinned Remote Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README.md:23-26
Vulnerability Type: Supply-chain risk from executing a mutable remote package version
Risk Level: Medium

Vulnerable Code Snippet:

bash
# Or as an OpenClaw skill via ClawHub
npx clawhub@latest install claude-usage

Technical Analysis

The documented installation command instructs users to execute clawhub@latest through npx. The latest tag is mutable and does not identify the exact package release reviewed by the user or project maintainer. npx may download the selected package and execute its entry point locally.

Consequently, the code executed during installation can change after this project has been audited. The command does not pin an exact version or verify an integrity digest. If the upstream package, publisher account, registry record, or release process is compromised, following the documented instructions could execute an attacker-controlled installer.

This is a supply-chain weakness in the installation documentation rather than evidence that the bundled project scripts are malicious.

Attack Path

  1. An attacker compromises the upstream clawhub package, its publishing credentials, or the package registry distribution channel.
  2. The attacker publishes a malicious release and assigns or causes the mutable latest tag to resolve to that release.
  3. A user follows the installation command from README.md.
  4. npx retrieves the package currently referenced by clawhub@latest.
  5. The downloaded package executes with the permissions of the user running the command.
  6. Malicious package code can perform actions permitted to that user before or during installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user invoking npx. Depending on that user's permissions and environment, the malicious dependency could access user-readable files, envir ...[truncated 350 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable latest tag with an exact, reviewed package version, for example:
    bash
    npx clawhub@<reviewed-version> install claude-usage
  2. Document the expected package publisher, registry, and release provenance so users can verify that they are retrieving the intended package.
  3. Where supported, verify the downloaded package against a published cryptographic checksum, signature, or registry integrity digest.
  4. Review new installer versions before updating the pinned command.
  5. Advise users not to run the installation command with administrator or root privileges.
  6. Consider documenting a manual installation method that allows users to inspect the installer before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to execute npx clawhub@latest install claude-usage, which fetches and runs remote code at install time without a pinned version. If the upstream package is compromised or a breaking/malicious release is published, users following the instructions could execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to run a local Python script, read session data from the user's home directory, and persist configuration, but it declares no explicit tool scope or permissions. Without an allowlist, an agent/runtime may grant broader shell and filesystem access than the skill actually needs, increasing the risk of unintended file access, writes, or command execution if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a usage-reporting skill that calculates subscription metrics from session data, but this entrypoint invokes an external interpreter via child_process. Launching subprocesses is a broader execution capability than the stated purpose requires and is not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/claude-usage.py (reported line 155)May include surrounding context.

python
tz = ZoneInfo(tz_name)
    except ImportError:
        import subprocess
        offset = subprocess.check_output(["date", "+%z"]).decode().strip()
        h, m = int(offset[:3]), int(offset[0] + offset[3:5])
        tz = timezone(timedelta(hours=h, minutes=m))

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This code processes local session files under ~/.openclaw or ~/.moltbot and extracts per-session identifiers, timestamps, models, and usage statistics. While the module docstring says it scans session JSONL files, there is no runtime disclosure or stronger warning that potentially sensitive conversation metadata from local agent sessions will be read and summarized.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The script persists reset time, plan, and timezone to ~/.openclaw/claude-usage.json. Although --save implies persistence and the code prints the destination afterward, there is no pre-save disclosure in help text or confirmation that local configuration will be written to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.