Token Optimization

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.0

Overview

This token-optimization skill is mostly coherent, but it tells the agent to run an unbundled local Python script and update persistent memory files as part of its workflow.

Review this skill before installing. Its concise-answer and log-trimming guidance is ordinary, but only use it if you trust and can verify the local `token-show.py` script path and are comfortable with behavior changes being written into persistent memory files. Prefer a version that bundles the script, verifies it, and requires explicit approval before updating memory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: references/current-spec.md:33
• Finding: Mandatory Invocation of a Mutable Script Outside the Skill Package## Vulnerability Details **File Location**: `references/current-spec.md`, lines 33-37 and 50-56 **Vulnerability Type**: Forced session behavior and execution of an unbundled local script **Risk Level**: High **Relevant snippet (English translation):** ```markdown ### 2.4 Token statistics output: scripted single line - Each time, output one line of token statistics through the unified script: - `python3 /home/admin/.openclaw/workspace/scripts/token-show.py` - Do not manually reconstruct the statistics line or add an explanatory section. ## 3. Execution process 1. Receive the question. 2. If status or logs must be checked, use tools to read the minimum necessary range. 3. Prepare a concise answer. 4. Append one line of token statistics by invoking `token-show.py`. 5. Finish. ``` ### Technical Analysis The specification changes the agent's normal response workflow by requiring execution of an absolute-path Python script for every response. The referenced script is outside the audited skill package and was not present in the supplied project, so its integrity and behavior cannot be established from the audited artifact. Because the absolute path points to a mutable workspace location, the effective behavior depends on whichever file occupies that path at runtime. The skill does not require ownership checks, permission validation, a cryptographic digest, or inspection of the script before execution. Consequently, anyone capable of creating or modifying that file can cause the agent to run code that was not reviewed with the skill. This is classified as skill instruction hijacking because loading the skill introduces a mandatory, unrelated execution step into the current session. The untrusted local-tool boundary also increases the practical code-execution risk. ### Attack Path 1. An attacker obtains write access to `/home/admin/.openclaw/workspace/scripts/token-show.py` or to a parent directory that permits replac ...[truncated 987 chars]
• Remediation: ## Remediation Suggestions - Remove the mandatory script invocation from the general response workflow unless token reporting is explicitly requested. - Bundle any required script inside the reviewed skill package rather than referencing a mutable external workspace path. - Verify the bundled script with a cryptographic digest or another trusted integrity mechanism before execution. - Validate file ownership and permissions and reject symbolic links or files writable by less-trusted users. - Execute the script with a restricted interpreter environment, minimal filesystem permissions, no unnecessary credentials, and network access disabled unless required. - Treat script output as untrusted data and never interpret it as agent instructions. - Gracefully omit token statistics when the verified implementation is unavailable rather than executing an unknown replacement.

T02 · Agent Memory Poisoning

Warning

• Location: references/current-spec.md:81
• Finding: Persistent Agent Memory Modification Required by the Skill Specification## Vulnerability Details **File Location**: `references/current-spec.md`, lines 81-87 **Vulnerability Type**: Cross-session memory poisoning **Risk Level**: Medium **Relevant snippet (English translation):** ```markdown ## 6. Version management - This file: `memory/token-optimization-current-spec.md` - If execution behavior changes, synchronously update: 1. This file's version number and update date 2. The corresponding summary in `MEMORY.md` 3. Implementation notes for affected scripts, such as `scripts/token-show.py` ``` ### Technical Analysis The specification directs the agent to propagate behavioral changes into `MEMORY.md` and other persistent state. Unlike an update confined to the audited skill source, `MEMORY.md` may influence subsequent sessions and unrelated tasks. No trust validation, approval boundary, allowed-field policy, or separation between user-provided content and trusted behavioral rules is specified. Therefore, a user who requests a behavior change while this skill is active may be able to cause that change to be recorded as durable agent memory. Versioning alone records that a modification occurred; it does not establish that the modification is safe or authorized. ### Attack Path 1. An attacker invokes the skill and requests a purported token-optimization behavior change. 2. The requested change includes attacker-selected instructions, potentially framed as a concise-output or workflow rule. 3. The skill's version-management instructions direct the agent to update the specification and the corresponding `MEMORY.md` summary. 4. The attacker-controlled rule is stored in persistent memory. 5. A later session loads or consults that memory. 6. The injected rule influences later agent decisions beyond the original request and session. ### Impact Assessment Exploitation can persist attacker-selected behavioral instructions across sessions and may affect future requests that rely on t ...[truncated 257 chars]
• Remediation: ## Remediation Suggestions - Do not permit ordinary skill execution or untrusted user requests to modify global memory files. - Require explicit, separately authenticated administrator approval before persisting behavioral changes. - Keep skill-local version metadata separate from cross-session agent memory. - Apply a strict schema and allowlist to persistent updates; reject free-form instructions and executable content. - Record provenance, requesting identity, exact changes, and approval information for every memory update. - Present a reviewable diff before writing and provide an atomic rollback mechanism. - Ensure future sessions treat stored memory as untrusted contextual data rather than higher-priority instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The document is written as a normative specification entirely in Chinese and identifies its applicable assistants without indicating that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Static analysis

No suspicious patterns detected.