CostClaw — Token Cost Analyzer for OpenClaw

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:32 AM UTC
• Version: 0.3.1

Overview

CostClaw is a local cost-analysis skill with disclosed, purpose-aligned workspace/config inspection and no evidence of network transfer, persistence, or destructive behavior.

Install only if you are comfortable with a local script reading the selected workspace's top-level Markdown filenames/sizes and OpenClaw model configuration to estimate cost. Run it on a specific workspace path, avoid untrusted filenames when using JSON output for automation, and treat generated cost recommendations as estimates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/analyze.sh:362

Finding

Unescaped Attacker-Controlled Values in JSON Output

Content

View full analysis

Vulnerability Details

File Location: scripts/analyze.sh, lines 362–385
Vulnerability Type: Improper JSON encoding / output injection
Risk Level: Medium

Vulnerable Code

bash

echo "  \"workspace\": \"$WORKSPACE\","
echo "  \"model\": \"$MODEL\","
echo "  \"model_tier\": \"$MODEL_TIER\","
echo "  \"input_price_per_mtok\": $INPUT_PRICE,"
echo "  \"output_price_per_mtok\": $OUTPUT_PRICE,"
echo "  \"turns_per_day\": $TURNS_PER_DAY,"
echo "  \"workspace_tokens\": $total_ws_tokens,"
echo "  \"skill_tokens\": $skill_total_tokens,"
echo "  \"total_input_tokens_per_turn\": $total_input_tokens,"
echo "  \"daily_cost\": $daily_total,"
echo "  \"monthly_cost\": $monthly_total,"
echo "  \"optimized_monthly\": $optimized_monthly,"
echo "  \"savings_percent\": $pct_savings,"
echo "  \"files\": ["
for i in "${!file_names[@]}"; do
  comma=""
  [ "$i" -lt $((${#file_names[@]} - 1)) ] && comma=","
  echo "    {\"name\": \"${file_names[$i]}\", \"tokens\": ${file_tokens[$i]}, \"monthly_cost\": ${file_monthly[$i]}}${comma}"
done
echo "  ],"
echo "  \"recommendations\": ["
for i in "${!rec_descriptions[@]}"; do
  comma=""
  [ "$i" -lt $((${#rec_descriptions[@]} - 1)) ] && comma=","
  # Escape quotes in description
  desc=$(echo "${rec_descriptions[$i]}" | sed 's/"/\\"/g')
  action=$(echo "${rec_actions[$i]}" | sed 's/"/\\"/g')
  echo "    {\"rank\": $((i+1)), \"description\": \"$desc\", \"monthly_savings\": ${rec_savings[$i]}, \"action\": \"$action\"}${comma}"
done

Technical Analysis

The script constructs machine-readable JSON through string interpolation rather than a JSON encoder. Several values inserted into JSON strings can be influenced by untrusted workspace or configuration content:

• WORKSPACE is supplied as a command-line argument.
• MODEL is extracted from an OpenClaw configuration file or environment variable.
• file_names contains filenames from the scanned workspace.
• Recommendation descriptions can incorporate those filenames.

...[truncated 2098 chars]

Remediation

View remediation

Remediation Suggestions

Use a mature JSON serializer instead of constructing JSON manually. For example, use jq with --arg for strings and --argjson for validated numeric values.

If maintaining a dependency-free implementation is mandatory, implement and thoroughly test complete RFC 8259 escaping for:

• Double quotation marks.
• Backslashes.
• Newlines, carriage returns, tabs, and other control characters.
• Control bytes in the U+0000 through U+001F range.

Additional hardening measures should include:

1. Validate FORMAT against an explicit allowlist such as text and json.
2. Validate pricing and calculated values as numeric before emitting them as JSON numbers.
3. Encode WORKSPACE, MODEL, filenames, descriptions, and actions through the same centralized JSON-string function.
4. Add regression tests using paths, model values, and filenames containing quotes, backslashes, newlines, tabs, Unicode characters, and attempted JSON property injection.
5. Parse generated output with a strict JSON parser in tests to guarantee that every supported input produces exactly one valid JSON document.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly says the tool reads the user's actual workspace and config, but it provides no warning about what data may be accessed, whether any contents are transmitted, or how sensitive files should be handled. For a security-sensitive agent skill, this can mislead users into running analysis over confidential prompts, credentials, internal docs, or billing configuration without informed consent, increasing the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to run a workspace-reading script as the recommended default flow, but does not place a prominent warning or consent gate immediately before execution. Because the script reads actual config and workspace contents, users may unknowingly authorize inspection of sensitive local files when they only asked a general cost question.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate on common billing or efficiency questions, which can cause the agent to invoke a shell script without sufficiently explicit user intent for filesystem inspection. In this skill, activation leads directly to analysis of the user's actual workspace and config, so accidental triggering can expose more local data than the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script enumerates markdown files in the supplied workspace and reads local OpenClaw config files in the user's home directory to infer model and pricing inputs, but it provides no clear disclosure, consent prompt, or scope limitation before doing so. In an agent-skill context, silent inspection of user workspace contents and local configuration can expose sensitive project metadata, filenames, token-heavy documents, and configuration details beyond what the user may expect from a 'cost analyzer,' increasing privacy and trust risks even if the data is only used locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.