T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/analyze_usage.py:23- Finding
Excessive Access to Complete Main-Agent Conversation History
- Content
View full analysis
- Remediation
View remediation
Security audit
usage-stats
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it says, but it reads all local OpenClaw session history and saves ongoing usage summaries without enough activation or opt-out controls.
Review this before installing if your OpenClaw session history may contain sensitive conversations, command output, paths, or credentials. Use it only when you intentionally want an all-history report, and consider deleting or restricting access to ~/.qclaw/workspace/memory/usage_stats_latest.md and usage_stats_history.json after use. A safer version would require explicit confirmation, support date/session filters, offer no-persist output, and sanitize markdown fields.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_usage.py:530- Finding
Stored Markdown Injection Through Unescaped Session Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill clearly describes capabilities that require reading session files, writing reports/history, and likely invoking a script, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a mismatch between documented behavior and enforceable constraints, increasing the risk of over-privileged or unintended file and shell access when the skill is invoked.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include very broad terms like '统计', 'usage', 'report', and '我用了多少', which can appear in ordinary conversation and cause accidental activation. Because the skill reads all local session records and writes persistent output, an unintended invocation can expose private usage history or modify local memory files without sufficiently specific user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description tells the user it can 'run usage stats' but does not prominently warn that it will read all local session records under the user's home directory and write both a latest report and a history snapshot. This is a transparency and consent problem: users may reasonably expect a lightweight summary, not comprehensive local log processing and persistent storage of derived metadata.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction '直接告诉我…我调用脚本生成报告' explains how to use the skill but does not define boundaries for when it should or should not activate. In context, the skill performs broad local log analysis and persistence, so ambiguous invocation rules raise the risk of the agent launching file-reading and file-writing actions based on weak or inferred intent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill is designed to generate persistent reports, historical snapshots, and memory updates derived from session records. Even if intended for analytics, this creates session persistence beyond the original logs, potentially retaining sensitive behavioral metadata, error details, and usage patterns in additional files that may be accessed later or kept longer than expected.
- Content
md ## 核心功能 - ✅ **Token 统计**：input / output / cacheRead / cacheWrite / 总计 - ✅ **费用估算**：基于 usage 数据计算总费用 - ✅ **模型分布**：各模型的调用次数和 token 消耗 - ✅ **缓存命中率**：cacheRead / (cacheRead + cacheWrite)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill is designed to generate persistent reports, historical snapshots, and memory updates derived from session records. Even if intended for analytics, this creates session persistence beyond the original logs, potentially retaining sensitive behavioral metadata, error details, and usage patterns in additional files that may be accessed later or kept longer than expected.
- Content
md ## 核心功能 - ✅ **Token 统计**:input / output / cacheRead / cacheWrite / 总计 - ✅ **费用估算**:基于 usage 数据计算总费用 - ✅ **模型分布**:各模型的调用次数和 token 消耗 - ✅ **缓存命中率**:cacheRead / (cacheRead + cacheWrite)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 新增功能 - **Token 统计**：完整解析 input / output / cacheRead / cacheWrite / totalTokens - **费用估算**：基于 usage.cost 字段计算总费用 - **模型分布**：按模型分组统计 token 消耗和调用次数 - **缓存命中率**：cacheRead / (cacheRead + cacheWrite) × 100%
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 新增功能 - **Token 统计**:完整解析 input / output / cacheRead / cacheWrite / totalTokens - **费用估算**:基于 usage.cost 字段计算总费用 - **模型分布**:按模型分组统计 token 消耗和调用次数 - **缓存命中率**:cacheRead / (cacheRead + cacheWrite) x 100%
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The heading explicitly defines the output-format specification in Chinese, which imposes a language/locale expectation in the skill documentation. The file does not indicate that language is user-selectable or that the Chinese-only requirement is justified by a region-specific constraint.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script scans all session logs and persists aggregated data about user and assistant activity, including tool usage, timing, errors, and text-volume characteristics, into durable files under workspace memory. In the context of a usage-stats skill, broad cross-session aggregation is related to functionality, but persisting derived conversation metadata still creates a real privacy and surveillance risk if users are not informed or if other components can read those files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python total_output = 0 total_tokens = 0 cache_read = 0 cache_write = 0 total_cost = 0.0 msg_count = 0 turns = 0
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises usage statistics generation, but it also creates and retains a separate history file containing longitudinal snapshots of session-derived metrics. This expands data retention beyond a one-time report and can surprise users by persisting behavioral metadata over time without clear consent or retention limits beyond a rolling window.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script writes a markdown report and a JSON history file derived from all sessions into persistent workspace storage without any user-facing notice or consent step. Persisting conversation-derived analytics silently increases privacy risk, especially because the data is gathered from all session logs rather than only the current interaction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing natural language content exclusively in Chinese, including feature descriptions and technical details. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The top-level docstring describes the skill entirely in Chinese, indicating a fixed language/locale presentation rather than offering a user-selectable language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is documented and justified.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code parses raw session content to extract structured error details and later derives message text-length analytics, which goes beyond narrow token/cost accounting. Although it does not store full message bodies in the final history, it inspects conversation/tool output content and may surface snippets of errors that can contain sensitive paths, identifiers, or operational details.
- Content
Static analysis
No suspicious patterns detected.