ClawHub
Back to skill

Security audit

Token Cost Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a local cost-reference guide rather than malware, but it overstates active monitoring and alerting capabilities and includes optional external alert examples that conflict with its privacy claims.

Review this before installing if you need real budget controls. The included script will not monitor live usage or prevent overruns, and any Slack or email alert examples should be run only with explicit user intent and sanitized cost data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises an active cost monitoring and budget management tool. However, the supplied code is just a local shell script that echoes hardcoded pricing information and optimization suggestions. It does not read usage data, call any API, inspect logs, store metrics, compare spending against budgets, or emit alerts. The primary purpose is therefore materially different: static cost reference display rather than real-time spending monitoring and optimization automation.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

md
echo "Cost Optimization Tips:"
echo "  1. Use Haiku for simple queries (saves 90%)"
echo "  2. Reduce heartbeat frequency to 4-6 hours"
echo "  3. Clear context after completed tasks"
echo "  4. Batch similar tasks together"
echo "================================"

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
echo "Cost Optimization Tips:"
echo "  1. Use Haiku for simple queries (saves 90%)"
echo "  2. Reduce heartbeat frequency to 4-6 hours"
echo "  3. Clear context after completed tasks"
echo "  4. Batch similar tasks together"
echo "================================"

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/cost_checker.sh (reported line 36)May include surrounding context.

sh
echo "Cost Optimization Tips:"
echo "  1. Use Haiku for simple queries (saves 90%)"
echo "  2. Reduce heartbeat frequency to 4-6 hours"
echo "  3. Clear context after completed tasks"
echo "  4. Batch similar tasks together"
echo "================================"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill for broad situations like "checking API spending," "optimizing model costs," and "analyzing usage trends" without defining specific trigger phrases, exclusions, or narrow context. In a markdown skill description, this can create ambiguous activation conditions and unintended invocation overlap with many general finance or monitoring requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill includes an example that sends cost data to an external Slack webhook via curl. Even though it is framed as an integration example, it normalizes external transmission of potentially sensitive operational metadata, and if used with real values could leak spending patterns, account activity, or internal usage information to third-party endpoints.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

Slack/Discord Alerts

bash
# Send daily cost summary to Slack
curl -X POST https://hooks.slack.com/services/YOUR/WEBHOOK/URL \
  -d '{"text": "Daily OpenClaw cost: $5.00 (Budget: $10.00)"}'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes an operational monitoring tool with alerting, usage analysis, and budget-overrun prevention. In contrast, the code performs no monitoring, no API interaction, no session or model usage tracking, and no alerting; it simply echoes hardcoded pricing information and advice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.