ClawHub
Back to skill

Security audit

Cost Guardian

Security checks for vulnerabilities and agentic risk

Overview

This is a local cost-tracking skill that stores costs and token-usage summaries on the user's machine without evidence of exfiltration or hidden execution.

Before installing, be aware that running scan-tokens reads local OpenClaw gateway logs and records aggregate model/token/cost data in a local SQLite database. Use COST_GUARDIAN_DIR or edit config.json if you need the data stored somewhere else, and avoid running scans on shared systems unless that local usage history is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The `scan-tokens` feature parses gateway logs to extract token usage, but the skill does not warn that log files may contain sensitive metadata such as prompts, model names, request identifiers, timestamps, or other usage details. Without a privacy notice and scope clarification, users may unknowingly process or retain sensitive operational data.

Session Persistence

Medium
Category
Rogue Agent
Content
# ─── Database ─────────────────────────────────────────────────────────────────

def get_db():
    """Get database connection, create tables if needed."""
    DATA_DIR.mkdir(parents=True, exist_ok=True)
    conn = sqlite3.connect(str(DB_PATH))
    conn.row_factory = sqlite3.Row
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Tainted flow: 'CONFIG_PATH' from os.environ.get (line 25, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
def save_config(config):
    """Save config."""
    DATA_DIR.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_PATH, "w") as f:
        json.dump(config, f, indent=2)
Confidence
65% confidence
Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The scan-tokens feature reads multiple log locations, parses model/usage metadata, and persists the results into a local SQLite database without any consent prompt, redaction step, or retention control. While it does not exfiltrate data, gateway logs can contain sensitive operational metadata, and silently aggregating that information into another persistent store increases exposure if the workstation or data directory is later accessed by another user or process.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill instructs users to run initialization and tracking commands that create persistent files under `~/.openclaw/workspace/costs/`, but it does not clearly warn that local state will be written to the user's home directory. This can surprise users, affect privacy expectations, and leave residual financial data on shared or managed systems.

Static analysis

No suspicious patterns detected.