ClawHub
Back to skill

Security audit

Cost Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent cost-saving toolkit, but it needs Review because bundled scripts unsafely execute configuration files and handle API tokens/webhooks without enough safeguards.

Install only after reviewing the scripts or using a fixed version. Avoid running its audit/report/dashboard scripts on any untrusted or externally supplied config file, do not pass API keys on the command line, keep generated config and instances files private, use HTTPS-only trusted endpoints for providers and webhooks, and require explicit confirmation before applying patches or installing cron jobs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/parse-config.js:20
Finding

Arbitrary Code Execution Through Unsafe Configuration Evaluation

Content
View full analysis
{ require('child_process').execSync('attacker-controlled-command'); return true; })() }) ``` Because the generated function executes in Node.js, the payload can potentially access Node.js globals and obtain powerful capabilities through techniques available in the runtime. This is substantially more dangerous than ordinary malformed-configuration handling. ### Attack Path 1. An attacker modifies an OpenClaw configuration file, supplies a malicious alternative configuration, or distributes a malicious preset that later becomes configuration data. 2. The user or Agent invokes o ...[truncated 901 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/multi-instance.sh:56
Finding

JavaScript Injection Through Shell-Interpolated File Paths

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fallback-validator.sh:67
Finding

Provider API Credentials Can Be Transmitted to Arbitrary or Plaintext Endpoints

Content
View full analysis
{ const isAnthropic = api === 'anthropic-messages'; const url = new URL(baseUrl); const path = isAnthropic ? '/v1/messages' : '/v1/chat/completions'; const body = isAnthropic ? JSON.stringify({ model: modelId, max_tokens: 5, messages: [{ role: 'user', content: 'hi' }] }) : JSON.stringify({ model: modelId, max_tokens: 5, messages: [{ role: 'user', content: 'hi' }] }); const headers = { 'Content-Type': 'application/json', ...(isAnthropic ? { 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' } : { 'Authorization': 'Bearer ' + apiKey }), }; const opts = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: path, method: 'POST', headers, timeout: 10000, }; const start = Date.now(); const mod = url.protocol === 'https:' ? https : http; const req = mod.request(opts, (res) => { const latency = Date.now() - start; let data = ''; res.on('data', d => data += d); res.on('end', () => { let error = null; if (res.statusCode >= 400) { try { error = JSON.parse(data)?.error?.message || data.substring(0, 100); } catch(e) { error = data.substring(0, 100); } } resolve({ status: res.statusCode, latency, error, up: res.statusCode < 400 }); }); }); req.on('error', (e) => resolve({ status: 0, latency: 0, error: e.message, up: false })); req.on('timeout', () => { req.destroy(); resolve({ status: 0, latency: 10000, error: 'timeout', up: false }); }); req.write(body); ``` ### Technical Analysis The fu ...[truncated 1895 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/multi-instance.sh:70
Finding

Remote Gateway Bearer Tokens May Be Exposed Over Plaintext HTTP

Content
View full analysis
{ const parsed = new URL(url + '/api/config'); const mod = parsed.protocol === 'https:' ? https : http; const req = mod.get({ hostname: parsed.hostname, port: parsed.port, path: parsed.pathname, headers: { 'Authorization': 'Bearer ' + token }, timeout: 10000, }, (res) => { let data = ''; res.on('data', d => data += d); ``` The script's documented example also permits an HTTP URL: ```json { "name": "personal", "url": "http://localhost:3578", "token": "your-gateway-token", "description": "Personal assistant" } ``` ### Technical Analysis The multi-instance aggregator sends a gateway bearer token to each configured URL. It selects the HTTP client based on the supplied protocol and does not prevent plaintext HTTP for non-loopback hosts. Bearer tokens grant access to whoever possesses them. HTTP provides no confidentiality or server authentication, so the token can be observed or modified in transit. Although loopback HTTP can be reasonable for a local service, the implementation does not ensure that an HTTP hostname resolves exclusively to loopback. The script retrieves the complete `/api/config` response even though it only needs a small number of model and heartbeat fields. Returning the complete remote configuration increases exposure if that endpoint includes provider details or secrets. ### Attack Path 1. A user adds a remote instance using an HTTP URL, or an attacker changes an instance URL from HTTPS to HTTP. 2. The user runs `multi-instance.sh`. 3. The script sends the gateway token in a plaintext `Authorization` header. 4. A network attacker captures the token. 5. The attacker reu ...[truncated 538 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup-openrouter.sh:29
Finding

OpenRouter API Key Stored in Predictable Insecure Temporary File

Content
View full analysis
"$PATCH_FILE" << PATCH { "models": { "providers": { "openrouter": { "baseUrl": "https://openrouter.ai/api/v1", "apiKey": "$API_KEY", ``` The key is also accepted directly as a command-line argument: ```bash API_KEY="${1:-}" ``` ### Technical Analysis The script writes the OpenRouter API key into a fixed, predictable path under `/tmp`. It does not set a restrictive `umask`, atomically create a new file, verify that the destination is not a symbolic link, set mode `0600`, or delete the secret-bearing file after use. Depending on the system's default `umask`, the generated patch may be readable by other local users. Because the pathname is predictable, another local user may pre-create it as a symbolic link, causing the script to overwrite a file writable by the victim. Concurrent runs can also overwrite each other's patches. Passing the API key as a command-line argument may expose it through shell history or process inspection. Additionally, direct interpolation into JSON does not escape quotes, backslashes, or control characters, so unusual input can produce malformed or attacker-influenced patch structure. ### Attack Path 1. A local attacker monitors `/tmp` or pre-creates `/tmp/openrouter-setup-patch.json` as a symbolic link. 2. The victim runs `setup-openrouter.sh` with a valid API key. 3. The script writes the key to the predictable destination. 4. The attacker reads the file or receives the data through the symlink target. 5. The attacker reuses the key for unauthorized provider requests. Separately, the key may remain in shell history or be visible in a process listing while the command is running. ### Impact Assessment The primary impact is disclosure ...[truncated 336 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (52)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Although the command targets only the skill directory, it is still a forceful recursive deletion command presented as copy-pasteable documentation. In an agent-skill context, users may execute shell commands with elevated trust, so destructive instructions deserve extra caution even when the immediate path is narrow.

Content

Scanner excerpt · GUIDE.md (reported line 672)May include surrounding context.

Uninstalling

bash
rm -rf ~/.openclaw/workspace/skills/cost-optimizer

Config changes made during setup remain. To revert:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Although the command targets only the skill directory, it is still a forceful recursive deletion command presented as copy-pasteable documentation. In an agent-skill context, users may execute shell commands with elevated trust, so destructive instructions deserve extra caution even when the immediate path is narrow.

Content

Scanner excerpt · GUIDE.md (reported line 672)May include surrounding context.

Uninstalling

bash
rm -rf ~/.openclaw/workspace/skills/cost-optimizer

Config changes made during setup remain. To revert:

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The supplied code only performs OpenRouter provider configuration generation. That partially aligns with the description's mention of free model usage and setup, but it does not substantiate the much broader claimed functionality: large-scale cost optimization, routing, session management, output efficiency, or the suite of operational scripts. Additionally, the script accepts and writes an API key into a generated patch file, which is a resource/access behavior not reflected by the empty declared permissions. Because the implemented behavior is materially narrower than the declared purpose and includes access to sensitive configuration data, this is a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
| Agent instructions | `SKILL.md` (this file) | 13 chapters of cost optimization logic |

Memory Manipulation

High
Category
Memory Poisoning
Confidence
82% confidence
Finding

The skill repeatedly encourages saving selected facts to memory and using /reset to clear context, which can manipulate what information remains salient to the agent across sessions. In the wrong context, this can suppress relevant safety history, reduce auditability, or bias the agent toward retained cost-related preferences over fresh user intent.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
- [Key point 1]
- [Key point 2] 
- [Any open items]
Type /reset to clear context and reduce costs."

### Context Pruning in Responses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 604)May include surrounding context.

md
- `scripts/cost-dashboard.js [config] [output.html]` — HTML cost dashboard

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

When the log file is missing, the script reads the OpenClaw config and evaluates it with new Function('return ('+raw+')')(), which executes the file contents as JavaScript instead of parsing data safely. If an attacker can modify that config file, running this reporting script will execute arbitrary code with the user's privileges, an unjustified capability for a log inspection utility.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script reads the target config file and parses it with new Function('return (' + raw + ')')(), which executes the file contents as JavaScript instead of treating it as inert data. If an attacker can modify the config file or trick a user into diffing an untrusted path, arbitrary code runs with the user's privileges merely by viewing a config diff.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/context-monitor.sh (reported line 36)May include surrounding context.

sh
let logLines = [];
try { logLines = fs.readFileSync(logPath, 'utf8').split('\n'); } catch(e) {}

// Try to extract context size from logs
const contextData = [];
for (const line of logLines) {
  // Look for context size patterns like 'context: 85k/200k' or 'tokens: 85000'

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script reads the user-supplied OpenClaw config and evaluates it with new Function('return ('+raw+')')(), which executes the file as JavaScript rather than safely parsing data. If an attacker can influence the config file or trick a user into auditing a malicious config path, arbitrary code can run in the context of the user invoking the audit script.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The shell script passes the supplied config path into multiple inline Node commands and processes the target file without any warning that analysis will execute code. In a skill whose purpose is routine cost auditing, users are likely to run it on their normal config or shared configs, making this dangerous because a benign-looking audit command can become arbitrary code execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script parses the config by passing its contents into new Function(...), which executes the file as JavaScript rather than treating it as data. If an attacker can modify the config file or trick a user into pointing the script at a malicious path, arbitrary code will run with the privileges of the user executing the dashboard generator.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Because the config file is executed as code, the script performs a dangerous action that users would reasonably expect to be a passive read. In a cost-optimization skill with many executable scripts and optional user-supplied paths, this hidden code execution materially increases the chance of accidental exploitation or abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script reads the config file and evaluates it with new Function('return (' + raw + ')')(), which treats configuration as executable JavaScript rather than data. If an attacker can modify the config file or convince a user to point the script at a crafted file, arbitrary code will run in the user's context when this helper is invoked; that capability is unrelated to simply displaying model choices. In this skill context, the danger is increased because the script invites use with a configurable path argument and is part of a toolkit likely to be run routinely on developer machines.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The local analysis path reads an arbitrary config file and evaluates its contents with new Function, which executes attacker-controlled JavaScript if the config file is modified or if a malicious path is supplied in instances.json. That is far beyond what a cost-reporting script needs and can lead to arbitrary code execution under the user's privileges when the audit is run.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script reads the config file and evaluates it with new Function('return (' + raw + ')')(), which executes arbitrary JavaScript embedded in the config instead of safely parsing data. If an attacker can modify the config file or convince a user to run the script against a crafted path, they can achieve arbitrary code execution in the user's context. In a cost-optimization skill, this is especially dangerous because users are likely to run diagnostic scripts against trusted-looking local config files without suspecting code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The config contents are executed implicitly as JavaScript with no warning, confirmation, or indication to the user that running the comparison script can run code from the config file. This creates a silent trust boundary violation: a user expects analysis of configuration data, but instead the script grants code execution to that file. Given this skill ships many utility scripts and encourages setup/automation, the lack of warning increases the chance users run it routinely on untrusted or previously modified configs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script reads the user-supplied config file and evaluates it with new Function('return (' + raw + ')')(), which executes the file contents as JavaScript instead of parsing it as data. If an attacker can modify the config file or convince a user to run the script against a crafted config path, they can achieve arbitrary code execution in the context of the user running the health check. In a utility script that is expected to only inspect provider settings, this greatly exceeds the expected trust boundary and makes the issue more dangerous.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · CHANGELOG.md (reported line 7)May include surrounding context.

md
### Added
- **GUIDE.md** — Complete user guide with requirements, installation, example outputs from every script (captured from a live instance), and common workflows.
- **Chapter 14: Scripts Reference** in SKILL.md — Full script listing with usage syntax so the agent knows how to invoke every tool.
- **Quick Start section** in SKILL.md frontmatter — Requirements, install commands, first run.

### Improved

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide recommends sending daily cost summaries to arbitrary webhooks but does not warn that reports may contain configuration-derived metadata, model/provider details, instance names, and usage patterns that could be disclosed to third parties. In a security-sensitive environment, this can leak operational data or secrets if the webhook URL is misconfigured, points to an untrusted service, or is exposed in shell history/logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The multi-instance example includes bearer-style tokens inline in a JSON file without emphasizing that they are sensitive credentials. Documentation like this normalizes storing and sharing secrets in plaintext, increasing the chance users commit them to repos, paste them into chats, or leave them world-readable on disk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · GUIDE.md (reported line 664)May include surrounding context.

md
3. Install the daily report cron via your agent

### "I have multiple instances"
1. Create `~/.openclaw/instances.json` with your instance URLs
2. `bash multi-instance.sh` — see total spend across all instances

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises sending daily reports to Discord, Slack, or any webhook but does not clearly warn that usage metrics, model/provider details, host metadata, or other operational data may be transmitted to third-party services. In a skill centered on auditing and reporting API usage, users may enable webhook reporting without understanding the privacy and data-exposure implications, especially if webhook endpoints are external or misconfigured.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill instructs the agent to read/write memory files, modify configuration, run bash scripts, make networked API calls, and potentially use environment-provided secrets, but it declares no explicit tool scope or allowed-tools policy. That mismatch weakens least-privilege controls and can let a broadly capable agent execute filesystem, shell, or network actions the user may not expect from the manifest alone.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The first-activation trigger is broad enough that the skill may start steering setup, file writes, or configuration changes whenever it believes it is 'first activated' or sees a matching phrase. Ambiguous activation logic can cause unintended privileged actions, especially in an agent environment where natural-language prompts are easy to spoof or trigger accidentally.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.dynamic_code_execution

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
GUIDE.md:672

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/compaction-log.sh:34

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/config-diff.sh:29

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/cost-audit.sh:42

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/cost-dashboard.js:14

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/fallback-validator.sh:32

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/idle-sleep.sh:81

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/model-switcher.sh:30

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/multi-instance.sh:95

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/parse-config.js:23

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/preset-manager.sh:35

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/provider-compare.sh:29

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/provider-health.sh:35

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/token-enforcer.sh:63

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/webhook-report.sh:41