Security audit

Token Alert

Security checks across malware telemetry and agentic risk

Overview

The skill’s token monitoring purpose is plausible, but the dashboard also has broad local session-control and export powers that need careful review.

Review this before installing if you use sensitive Clawdbot sessions. The basic token checker is coherent, but the dashboard can access and export chat history, send commands into a session, and trigger a memory-saving summary automatically near 90% usage. Avoid running the optional notification setup or provider setup unless you accept the recurring background job and local plaintext configuration behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (47)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The script uses SimpleHTTPRequestHandler, which serves files from the current working directory, while the docstring implies it is limited to a specific dashboard. This mismatch can expose unintended local files under the launch directory, and the permissive CORS policy allows browser-based access patterns that make accidental data exposure more likely if sensitive files are present.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The page presents itself primarily as a monitoring dashboard, but it also includes actions that modify session state and trigger data-handling workflows such as summary generation and export. This is dangerous because users may trust it as read-only telemetry while it can send authenticated requests that alter or persist conversation content without clear, upfront disclosure.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The settings UI suggests the gateway token can be changed, but authenticated requests use the hard-coded GATEWAY_TOKEN constant instead. This mismatch is deceptive and security-relevant because users may believe they have rotated or replaced credentials when the application continues using an embedded secret.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The UI is presented as a token-alert dashboard, but it also exposes active capabilities to send summarization commands and export session contents. That materially expands the skill’s authority from passive monitoring to data access and persistence, increasing the chance of unintended disclosure of sensitive conversation data.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The dashboard enumerates sessions and retrieves session history/functions not strictly necessary for token monitoring. In this context, multi-session discovery broadens visibility into other conversations and can expose metadata or content across sessions without a clear need-to-know boundary.

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: Clicking a session reveals the full internal session key in a notification even though switching is not implemented. Session identifiers can contain operational metadata and may aid enumeration, correlation, or later misuse if exposed to end users or shoulder-surfed.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This dashboard goes beyond passive monitoring and includes active session-control features such as opening new sessions, sending summary instructions, and exporting session history. Those capabilities can cause sensitive conversation contents to be transmitted to backend tools or written to files/memory, which is dangerous in a monitoring UI because users may not expect administrative or exfiltration behaviors.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The page exposes a gateway bearer token in the client and also stores editable token configuration in browser localStorage. Any script running in the origin, including injected scripts or a compromised dependency, could read and reuse that token to access backend tools and session data.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The UI presents the action as summary creation, but the instruction sent to the backend also tells the agent to store the summary in memory. That mismatch reduces informed consent and creates an unexpected persistence path for sensitive session content, decisions, and tasks.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The dashboard is not merely displaying status: the Summary action issues an authenticated sessions_send command that injects a message into a live session and instructs the agent to persist a summary into memory/. That gives a monitoring UI session-modifying and memory-writing capability, which is dangerous because any user opening the page, or any script/XSS running in the page, can trigger state-changing actions against the backend.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The Export action retrieves sessions_history for a session and writes the full conversation to a downloadable local markdown file. Exporting full transcript content from a lightweight dashboard expands the data-exfiltration surface, especially because the page already contains embedded credentials and can be driven by any script running in the same origin.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: A token-monitoring dashboard includes actions to export full session history and send summarization instructions that persist data to memory storage, which exceeds the narrow purpose of usage monitoring. This creates a data exfiltration and over-collection risk because a user may interact with a seemingly harmless dashboard that can retrieve and persist sensitive conversation content.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The dashboard enumerates sessions across multiple channels and exposes metadata such as channel, token counts, and activity timing, which goes beyond a minimal token-alert function. This broadens visibility into user communications and increases privacy risk if the dashboard is accessed by an unintended party or embedded in a lower-trust context.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file claims it tracks Gemini token usage via the API, but `get_usage()` never retrieves actual usage data and always sets `used = 0`. This can mislead users or downstream automation into believing token consumption is negligible, which may cause budget overruns, quota exhaustion, or incorrect operational decisions based on false telemetry.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: This server subclasses SimpleHTTPRequestHandler, so in addition to proxying /api/* it also serves files from the current working directory over HTTP. That broadens exposure beyond the stated CORS-proxy purpose and can unintentionally disclose local project files, configuration, or secrets to any local webpage because the server also enables permissive CORS.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The report documents an automatic export and follow-on summary trigger at ≥90% usage, which are data-affecting actions, but it does not describe any explicit user consent, confirmation, scope limitation, or warning before those actions occur. In a dashboard/skill context, automatic export or summarization can move, persist, or transform user data unexpectedly, creating privacy, retention, or unintended disclosure risks if sensitive session content is included.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The report describes push notification support and permission requests but does not mention privacy considerations such as what information may appear in notifications, when they are sent, or how users can control them. Notifications can expose sensitive usage state on a locked screen or shared device, so documenting and designing them without clear user-impact warnings creates a real, though limited, privacy issue.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup section tells users to run a shell script that installs terminal-notifier and configures checks every 5 minutes, but it does not clearly warn that this performs software installation and creates a recurring background task. That weakens informed consent and increases the chance a user executes persistent system changes without understanding them.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The README advertises automatic session backup/export at high token thresholds without warning about what conversation data may be saved, where it is stored, or who can access it. In a chat assistant context, exports may contain sensitive prompts, credentials, business data, or personal information, so silent or poorly explained backup behavior creates real privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises Telegram alerts and says it 'sends Telegram alert if threshold crossed' without warning that session-usage metadata is transmitted to an external service. Even if the content is only token-usage statistics, it reveals behavioral/session information and may expose usage patterns to third-party infrastructure, which is a privacy and data-handling concern.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The planned web-scraping fallback explicitly includes browser-based scraping and session cookie management for third-party services. Handling authenticated session cookies creates a high risk of account takeover, credential/session theft, privacy violations, and breaking provider terms, especially because the TODO does not mention user safeguards, secure storage, scope limitation, or lifecycle controls.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Telegram push notifications imply sending usage or account-related data to a third-party messaging platform, yet the TODO contains no privacy notice, data-minimization plan, or control over what gets transmitted. This can leak sensitive usage metadata, provider names, limits, or behavioral patterns to an external service or unintended recipients.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code persists the full provider configuration directly to a JSON file, and that configuration may include API keys or other secrets. Storing credentials in plaintext on disk increases the risk of local disclosure through weak filesystem permissions, backups, logs, or other processes reading the file, and there is no user-facing warning or protection mechanism here.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A bearer token is hard-coded directly into client-side HTML/JavaScript and then sent in authenticated network requests. Any user or script with access to the page can recover the token, reuse it against the gateway, and potentially access session data or invoke privileged tools.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The code automatically triggers export and summary actions once usage crosses a threshold, without requiring contemporaneous user consent. Because these actions can persist, transform, or disclose conversation contents, the automation creates a high risk of unintended data handling and user surprise.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.