ClawHub
Back to skill

Security audit

Token Budget

Security checks for vulnerabilities and agentic risk

Overview

This is a local token and spend tracking skill with minor trigger and documentation issues, but no evidence of exfiltration, destructive behavior, or unsafe persistence.

Before installing, understand that ordinary questions about spend or tokens may invoke this skill and may reveal local usage estimates in the session. Its local budget-state file use appears purpose-aligned, but the publisher should clarify exactly when it reads or writes that file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation conditions are broad enough to trigger on ordinary conversation about costs, token usage, or spend, which can cause unintended skill invocation and instruction-context injection. In an agent environment, overly broad natural-language triggers increase the chance that the skill alters behavior, distracts from the primary task, or exposes session usage details when the user did not explicitly request the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The 'Data Sources' section states the skill reads a local state file for thresholds and history, and earlier commands describe setting a soft threshold and maintaining history. However, line L99 says 'All tracking is local and read-only from session context,' which contradicts the documented need to persist or at least access mutable local state beyond the session context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The prompt "How much have I spent today?" is broad everyday language that could be said in many contexts, so it may activate this skill unintentionally when a user is discussing cost generally rather than requesting the token-budget tool. Because this skill is about budget tracking, accidental invocation is less dangerous than in a high-risk capability, but it can still cause incorrect routing, user confusion, or unintended disclosure of usage/cost information in conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The prompt "How many tokens have we used this session?" is less generic than normal conversation, but it is still a natural-language trigger without an explicit namespace or command boundary. That can cause unintended activation during broader discussions about tokens, sessions, or context windows, leading to misrouting and possible exposure of internal usage/accounting data.

Content

No source excerpt is available for this finding.