Security audit
Security checks for vulnerabilities and agentic risk
This is a local cost-tracking skill that stores costs and token-usage summaries on the user's machine without evidence of exfiltration or hidden execution.
Before installing, be aware that running scan-tokens reads local OpenClaw gateway logs and records aggregate model/token/cost data in a local SQLite database. Use COST_GUARDIAN_DIR or edit config.json if you need the data stored somewhere else, and avoid running scans on shared systems unless that local usage history is acceptable.
The scan-tokens feature parses gateway logs to extract token usage, but the skill does not warn that log files may contain sensitive metadata such as prompts, model names, request identifiers, timestamps, or other usage details. Without a privacy notice and scope clarification, users may unknowingly process or retain sensitive operational data.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# ─── Database ─────────────────────────────────────────────────────────────────
def get_db():
"""Get database connection, create tables if needed."""
DATA_DIR.mkdir(parents=True, exist_ok=True)
conn = sqlite3.connect(str(DB_PATH))
conn.row_factory = sqlite3.Row
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save_config(config):
"""Save config."""
DATA_DIR.mkdir(parents=True, exist_ok=True)
with open(CONFIG_PATH, "w") as f:
json.dump(config, f, indent=2)
The scan-tokens feature reads multiple log locations, parses model/usage metadata, and persists the results into a local SQLite database without any consent prompt, redaction step, or retention control. While it does not exfiltrate data, gateway logs can contain sensitive operational metadata, and silently aggregating that information into another persistent store increases exposure if the workstation or data directory is later accessed by another user or process.
The skill instructs users to run initialization and tracking commands that create persistent files under ~/.openclaw/workspace/costs/, but it does not clearly warn that local state will be written to the user's home directory. This can surprise users, affect privacy expectations, and leave residual financial data on shared or managed systems.
No suspicious patterns detected.