T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/token-logger/handler.js:156- Finding
Excessive Logging of Complete Session Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Token Tracker
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible token-usage tracker, but its hook can run automatically and logs more session context than token tracking requires.
Review this skill before installing. It is not clearly malicious, but enabling it gives it persistent access to session-compaction events, local session status files, and usage records, and it may send usage summaries to Telegram through cron jobs. Do not enable the hook or scheduled reports unless you are comfortable with session IDs, model usage, cost summaries, and potentially logged event context being stored locally or announced externally. The hook should be fixed to stop logging full context and to validate session keys before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/token-logger/handler.js:88- Finding
Unvalidated Session Key Used to Construct a Local File Path
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
hooks/token-logger/handler.js:122- Finding
Invalid Await Expression Prevents the Installed Hook from Loading
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The documented purpose focuses on token monitoring and reporting, but the skill also introduces a hook triggered on session:compact:after and describes automated reporting/alerts that are not actually implemented in this file. That mismatch is dangerous because users may approve a seemingly simple billing utility without realizing it installs persistent event-driven behavior and can later send data externally via cron/channel integrations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs users to install a hook and copy files into managed hook directories, which implies file read/write and persistent modification capabilities, yet it declares no explicit tool scope or permissions. This weakens informed consent and reviewability because users and platforms cannot easily tell that the skill persists files and alters runtime behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description does not prominently warn that the optional hook automatically records per-session token usage and that scheduled reports or alerts may be pushed to external channels such as Telegram. Even if only usage metadata is collected, session identifiers, model usage patterns, and spending summaries can be sensitive operational data and should not be exported without explicit user awareness.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This duplicate finding points to the same persistence behavior: installation into the managed hooks directory followed by activation causes the skill to run automatically in later sessions. In the context of a monitoring skill, persistence is somewhat expected, but it still needs explicit disclosure because it changes the trust model from manual use to background interception of usage events.
- Content
bash # 方法一：复制 hook 到 managed hooks 目录 mkdir -p ~/.openclaw/hooks/token-logger cp hooks/token-logger/HOOK.md ~/.openclaw/hooks/token-logger/ cp hooks/token-logger/handler.js ~/.openclaw/hooks/token-logger/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This duplicate finding points to the same persistence behavior: installation into the managed hooks directory followed by activation causes the skill to run automatically in later sessions. In the context of a monitoring skill, persistence is somewhat expected, but it still needs explicit disclosure because it changes the trust model from manual use to background interception of usage events.
- Content
bash # 方法一:复制 hook 到 managed hooks 目录 mkdir -p ~/.openclaw/hooks/token-logger cp hooks/token-logger/HOOK.md ~/.openclaw/hooks/token-logger/ cp hooks/token-logger/handler.js ~/.openclaw/hooks/token-logger/
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This manifest uses Chinese natural-language descriptions and agent instructions exclusively, including the top-level description and job payload messages. Per the language/locale policy rule, forcing a specific language without offering user choice or documenting a justified regional constraint is a policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The weekly and hourly job payloads instruct the agent entirely in Chinese and do not indicate any user opt-in, language selection, or region-specific limitation. Because these natural-language prompts govern agent behavior, they repeat the same locale-policy issue across multiple scheduled tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The hook documentation states that every session's token usage is automatically recorded to a TokenTracker database after session compaction, but it does not mention user notice, consent, retention, or privacy implications. Even if the logged fields are primarily usage metadata, per-session model usage can still reveal behavioral patterns, costs, and potentially correlate to sensitive activity, making silent collection a legitimate privacy and governance concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The hook logs the full event context and session identifier, which may contain prompts, summaries, metadata, or other user/system data not needed for token accounting. Because hook logs are often retained in plaintext and accessible to operators or other local processes, this creates an avoidable confidentiality leak path.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code emits verbose plaintext logs containing both per-session identifiers and the full event context, then also logs record objects when written. In a token-tracking skill, the operational need is billing/usage measurement, so retaining rich session-linked context is unnecessary and increases the chance of exposing sensitive conversation or system data through logs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The sample configuration hard-codes
Asia/Shanghaias the time zone, and the rest of the document is written as though that locale is the default behavior, without offering an opt-in choice. Under the policy, locale constraints should either be user-selectable or explicitly justified as region-specific.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The config hard-codes "Asia/Shanghai" as the time zone, which is a locale-specific behavior. Under the policy, fixed language or locale constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
SQP-3 applies to all file types and includes language policy violations. Multiple user-facing description lines are Chinese-only, and the file does not indicate that this is an intentional region-specific skill or provide an opt-in language choice, which can violate organizational language/locale expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file's descriptive comments are written in Chinese only, and the natural-language labeling throughout the file does not offer an alternative language or indicate that the skill is intended for a Chinese-only audience. Per the stated policy, forcing a specific language without opt-in can be a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The inline comment at L15 is written in Chinese while the rest of the script's user-facing text is in English. This creates an implicit language inconsistency without offering user choice or documenting a locale-specific reason, which matches the language/locale policy concern.
- Content
Static analysis
No suspicious patterns detected.