ClawHub
Back to skill

Security audit

token-usage

Security checks across malware telemetry and agentic risk

Overview

This skill is a local token and cost reporting utility that reads OpenClaw/Codex session logs and does not show exfiltration, persistence, destructive actions, or hidden privilege escalation.

Install only if you are comfortable with a local tool reading your OpenClaw/Codex session logs to summarize token usage. Treat reports as potentially sensitive because session filenames, model names, usage patterns, and cron job labels may reveal workflow details; review or avoid the optional pricing updater if you do not want outbound requests to OpenRouter.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The main parser generally matches the declared purpose by reading OpenClaw session files, aggregating token usage, and estimating/reporting costs. However, the skill contains additional capabilities not stated in the description: a pricing updater that makes outbound network requests to OpenRouter and writes local metadata files, plus logic to inspect user message text for cron-job tags and generate cron-specific reports. Those behaviors go beyond a straightforward session usage/cost tracker and therefore constitute a mismatch under the criteria.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest describes a skill to track, aggregate, and report token usage and costs across sessions. In addition to usage parsing, the code inspects user message text to detect embedded cron metadata and produces reports grouped by cron job, which is a distinct content-analysis capability not implied by simple token/cost tracking.

Intent-Code Divergence

Low
Confidence
83% confidence
Finding
The docstring says the function extracts cron metadata from the first user message in the session. The implementation actually iterates through messages until it encounters a user-role message, skipping non-message records first, so the documented source of truth is more specific than what the code guarantees.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The code fixes LOCAL_TZ to "Asia/Calcutta", which imposes a specific locale/timezone policy on all date filtering and reporting. The file does not offer a user choice or explain why this region-specific setting is required, so it can violate language/locale policy expectations.

Session Persistence

Medium
Category
Rogue Agent
Content
- Claude Sonnet 4: $3.00/1M input, $15.00/1M output
- GPT-4o: $2.50/1M input, $10.00/1M output

Costs are approximate. Cache read/write pricing applied when available.

## Important: What "Total" Means
Confidence
60% confidence
Finding
write pricing applied when available. ## Important: What "Total" Means The script reports **input + output tokens** as the usage metric. This is the actual new token consumption per turn. The `tota

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.