ClawHub
Back to skill

Security audit

Token Counter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local token-usage reporting utility that reads OpenClaw transcripts and can optionally save derived reports, with those behaviors largely disclosed and aligned with its purpose.

Install this only if you are comfortable with a local tool reading OpenClaw session transcripts and cron definitions to infer usage categories and client labels. Avoid --save or --output on shared or synced workspaces unless retaining derived session metadata and source paths is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation instructs running a local script that reads from OpenClaw session and cron data and can also write JSON output into the workspace, but the skill manifest declares no explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls because an agent may invoke file read/write behavior without clear, reviewable restrictions, increasing the risk of unintended access to sensitive transcript data or unauthorized file creation.

Unbounded Output

Medium
Category
Output Handling
Content
- `failure`: has errors and no successful assistant turns.
- `partial`: has errors, or model hit `max_tokens`, but session still made progress.
- `success`: no errors and no truncation indicators.

## Tool Token Attribution
Confidence
60% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill inspects transcript text for personal and business identifiers to infer a 'client' label, which expands processing beyond token counting into content-based profiling. Because transcript data may contain sensitive user/business information, this creates unnecessary secondary use of private data and can leak or persist inferred affiliations in generated reports.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest presents this skill as an analytics/reporting utility for understanding token spend, which implies reading transcript data and producing analysis. The code also persists output files to arbitrary paths and saves daily JSON snapshots under a workspace directory, adding stateful write behavior that is not described in the manifest.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The tool can save a full JSON report containing transcript-derived session metadata, labels, timestamps, paths, client/category inferences, and token usage to a predictable local directory without any explicit user-facing warning at save time. This increases the risk of unintended retention and later exposure of sensitive operational data on shared machines, backups, or synced folders.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The skill claims token-usage analysis with category attribution, but the implementation classifies sessions by reading user text, labels, cron job names, and cron payload messages, including hard-coded job IDs and business-specific keyword sets. This is a broader semantic inference layer over transcript contents rather than straightforward token usage reporting.

Static analysis

No suspicious patterns detected.