ClawHub
Back to skill

Security audit

Agent Metrics

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local agent metrics utility with ordinary logging and export risks, but no evidence of hidden or malicious behavior.

Install and run this in a normal least-privileged Python environment, consider pinning psutil yourself, and avoid storing secrets, tokens, raw prompts, or sensitive stack traces in labels/details because the tool writes and exports them as local JSON/CSV.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1-6 and 27-30
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

yaml
---
name: agent-metrics
version: 1.0.3
description: Observability and metrics for AI agents - track calls, errors, latency
metadata: {"openclaw": {"emoji": "📊", "category": "utility", "requires": {"bins": ["python"], "pip": ["psutil"]}, "homepage": "https://github.com"}}
---
powershell
# Install Python dependency
pip install psutil

Technical Analysis

The Skill declares and instructs users to install psutil without pinning an audited version or verifying a cryptographic hash. Consequently, dependency resolution selects whatever release satisfies the unconstrained package name at installation time. The installed code can therefore differ from the dependency that was present when the Skill was reviewed.

This is a supply-chain weakness rather than evidence that the current psutil package is malicious. Exploitation would require compromise of the package's distribution account, the package index, or the dependency resolution path. If such a compromise occurred, malicious package code could run during installation or when metrics.py imports psutil.

Attack Path

  1. An attacker compromises the dependency publisher, package-index distribution process, or another relevant dependency resolution channel.
  2. The attacker publishes a malicious or backdoored release under the expected psutil package name.
  3. A user follows the documented pip install psutil command, which resolves the uncontrolled release because no version or hash is specified.
  4. The malicious package executes code during installation or when metrics.py imports psutil.
  5. That code operates with the privileges and environmental access of the user running the installation or Skill.

Impact Assessment

Successful exploitation could pe ...[truncated 442 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin psutil to a specifically reviewed version in the Skill metadata and installation documentation.
  2. Provide a lock file or requirements file containing cryptographic hashes, and require hash verification during installation:
    text
    psutil==<reviewed-version> --hash=sha256:<verified-hash>
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Generate hashes from artifacts obtained through a trusted process and review dependency updates before changing the pinned version.
  4. Prefer a controlled package mirror or repository with integrity validation and restricted publishing controls.
  5. Run installation and the Skill using a dedicated, least-privileged environment rather than an administrator or root account.
  6. Incorporate automated dependency vulnerability and provenance checks into the release process.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly supports recording error details, resource usage, and exporting metrics, but the documentation does not warn that these fields can contain sensitive data such as prompts, stack traces, host information, file paths, tokens, or other operational secrets. In observability tooling, silent persistence and export of diagnostic data materially increases the risk of privacy leakage or unintended disclosure, especially when users may paste raw error text into the details field.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reset_metrics function replaces all existing metrics with empty collections and immediately writes them to disk, which is a destructive operation. Although it prints a success message afterward, there is no prior confirmation prompt or explicit warning to the user before data loss occurs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The argument parser documentation and choices explicitly present "custom" as a supported metric type, implying users can record custom metrics. However, the dispatcher only handles call, error, and latency, and falls into the unknown-type error path for anything else, directly contradicting the advertised behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.