Security audit

Vibe Billing Scan

Security checks for vulnerabilities and agentic risk

Overview

This billing skill has a coherent purpose, but it asks users to run an unpinned external tool on sensitive local API logs and offers a persistent proxy setup without enough scope or removal detail.

Review the `vibe-billing` npm package and its documentation before running it. Treat API logs as sensitive, inspect output before sharing it, and avoid `npx vibe-billing setup` unless you understand what proxy it installs, what traffic it observes, where data is stored or sent, and how to disable or uninstall it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README advertises very broad trigger phrases like "scan my api spend" and "why is my bill so high," which are close to ordinary conversational requests an agent user might naturally say. In agent environments that auto-match skills from natural language, this can cause unintended invocation of the billing-scan skill on sensitive logs or spend data without the user explicitly choosing the tool.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes very broad phrases like 'check my costs' and 'why is my bill high', which can match ordinary billing or spending questions without clearly limiting scope to OpenClaw/OpenClaw logs. That increases the chance of unintended invocation, causing the skill to prompt users to run external commands or disclose local billing/log data when a more general answer would have sufficed.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation guidance is broad enough to catch generic questions about token usage, spending, or waste, not just requests to run this specific local analyzer. In context, that matters because the skill's next step is to direct the user to execute `npx` commands, so an accidental invocation can escalate from harmless advice to unnecessary execution of third-party tooling and exposure of local log-derived data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill says it scans the user's local OpenClaw logs and API proxy data but does not warn that those sources may contain sensitive prompts, metadata, tokens, request contents, or operational history. Users may be encouraged to analyze or share results from sensitive local data without informed consent or minimization, creating privacy and confidentiality risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Presenting `npx vibe-billing setup` as an optional follow-up without a prominent warning obscures that it installs a proxy for future runs, which can alter traffic handling and collect ongoing request data. A proxy setup has materially higher sensitivity than a one-time scan, and users should be clearly informed about persistence, scope, and data capture before being encouraged to install it.

Static analysis

No suspicious patterns detected.