OpenClaw Model Usage

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:20 AM UTC
• Version: 1.2.1

Overview

This skill locally summarizes OpenClaw model-usage logs and optionally writes a local dashboard; the main privacy risk is sharing reports made from local session metadata.

Install only if you are comfortable letting the skill read local OpenClaw session logs under ~/.openclaw/agents. Review terminal output and any generated HTML dashboard before sharing, because reports can reveal usage patterns, agent/session names, channels, timestamps, models, token counts, and costs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose frames the skill as inspection of model usage, but the documented behavior also includes writing HTML files, producing session rankings/listings, and analyzing subagent/session-tree metadata. This mismatch can cause users or orchestration layers to approve a seemingly narrow reporting skill that actually performs broader data processing and local file output.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly encourages generating reports from real local OpenClaw logs but does not warn that those logs and the resulting dashboard/output may contain sensitive prompts, model usage metadata, session names, agent names, or other operational details. In a skill whose core purpose is to inspect and summarize local logs, missing privacy guidance increases the likelihood of accidental disclosure when users share terminal output or generated HTML reports.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill explicitly instructs use of shell commands, reads local session logs, and can write an HTML dashboard, but it declares no tool scope or permission boundaries. That omission weakens policy enforcement and increases the chance an agent invokes filesystem and shell capabilities without clear user visibility or least-privilege constraints.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill reads local session JSONL logs, which may contain sensitive operational data such as prompts, agent identities, model choices, token counts, and possibly embedded user content. Failing to warn about this data access undermines informed consent and may lead users to expose private usage history unintentionally.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code indexes and merges session metadata well beyond usage accounting, including channel, group identifiers, parent/child session relationships, labels, and working directory paths. That broadens the data exposed by the skill and can reveal operational context, filesystem locations, and conversation topology that are unrelated to the stated purpose of model-usage reporting.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill can generate and persist a self-contained HTML dashboard containing session-derived usage data to disk, and the UI text explicitly frames it as portable and easy to share. In a log-inspection skill, that materially increases the chance of unintended disclosure of sensitive local session information because data moves from ephemeral CLI output into a durable, shareable artifact.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The dashboard export writes HTML containing session-derived data but only reports success, without warning that the file may contain sensitive local metadata and is intended for sharing. This increases the likelihood of accidental privacy leaks because users may distribute or retain the file without understanding its contents or persistence.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(*args: str) -> str:
    python = str(PYTHON if PYTHON.exists() else Path(sys.executable))
    cmd = [python, str(SCRIPT), *args]
    return subprocess.check_output(cmd, text=True)


def main() -> int:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The dashboard command writes an HTML artifact to local disk, but the skill does not clearly warn users that a persistent file will be created. This can leave sensitive usage summaries stored in an accessible location longer than expected, especially if the output path is shared, synced, or served by another tool.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The dashboard is explicitly designed for easy sharing and contains session names, agent names, timestamps, model identifiers, token counts, and cost data. Even without direct secrets, this metadata can expose internal usage patterns, workflow structure, and operational details, and the skill context makes this more relevant because it processes local session logs and produces portable reports from them.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The dashboard template sets `<html lang="en">`, which forces an English locale in the generated output. The file does not provide any option for user selection or documentation that the English-only locale is intentional and justified.

Static analysis

No suspicious patterns detected.