ClawHub
Back to skill

Security audit

Agent Token Usage UI (deprecated)

Security checks for vulnerabilities and agentic risk

Overview

This deprecated skill is mostly a migration notice, but it tells users to install and run an unpinned external script that creates a persistent launchd job.

Install only if you trust the replacement agent-token-usage package and are comfortable with it installing a persistent launchd refresh job. Prefer reviewing the replacement skill's apply-ui.sh and remove-ui.sh, confirming the exact version, and understanding how to remove the launchd job before running the migration command.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:12
Finding

External Migration Script Installs a Persistent launchd Refresh Job

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-18
Vulnerability Type: T06: System Persistence
Risk Level: High

Complete Code Snippet:

markdown
```bash
clawhub uninstall agent-token-usage-ui
clawhub install agent-token-usage
bash ~/.openclaw/workspace/skills/agent-token-usage/apply-ui.sh

The 📊 button, modal, and launchd refresh job are all included in the main skill now under apply-ui.sh / remove-ui.sh.

text

### Technical Analysis

The migration instructions tell the user to execute `apply-ui.sh` from a separately installed package. The document explicitly states that this script installs a `launchd` refresh job. A launchd job is a cross-session execution mechanism on macOS and therefore constitutes system persistence under the specified classification.

The persistent behavior is disclosed rather than concealed, but the project does not include the referenced script, launchd property list, executed command, trigger conditions, or removal implementation. Consequently, this audit cannot verify whether the job is appropriately scoped, runs only as the current user, invokes immutable content, or is removed completely by `remove-ui.sh`.

### Attack Path

1. A user follows the migration instructions in `SKILL.md`.
2. The user installs the external `agent-token-usage` package.
3. The user executes its `apply-ui.sh` script through Bash.
4. According to the documentation, the script creates a launchd refresh job.
5. The installed job survives the original skill invocation and runs according to its configured launchd triggers.
6. If the external script or installed package is maliciously modified, the persistent job could repeatedly execute package-controlled commands.

### Impact Assessment

The confirmed scope is persistent execution through a launchd refresh job. Its exact privileges cannot be established from the reviewed project because neither the script nor its launchd co
...[truncated 609 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not install the launchd job as an implicit side effect of enabling the UI.
  • Require separate, explicit user consent before creating any persistent service or scheduled job.
  • Display the exact property-list contents, executable path, arguments, trigger conditions, and privilege level before installation.
  • Install the job with the least possible privilege, preferably as a user LaunchAgent rather than a system LaunchDaemon.
  • Ensure all referenced executables and configuration files are owned by the expected user and are not writable by less-privileged accounts.
  • Use absolute paths and a constrained environment in the launchd configuration.
  • Provide and test a complete removal procedure that unloads the job and deletes its property list and generated files.
  • Include the applicable scripts and launchd configuration in the reviewed package so their behavior can be audited before execution.

T08 · Insecure Dependencies

Error
Location
SKILL.md:13
Finding

Unpinned External Package Is Installed and Its Script Is Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Complete Code Snippet:

bash
clawhub uninstall agent-token-usage-ui
clawhub install agent-token-usage
bash ~/.openclaw/workspace/skills/agent-token-usage/apply-ui.sh

Technical Analysis

The migration command installs agent-token-usage without specifying an exact version, cryptographic digest, or verified signature. It then directly executes apply-ui.sh from the installed package. This creates a supply-chain trust boundary: the code executed by the user can differ from the version that existed when this deprecated skill was reviewed.

Although the description recommends version v0.2.0+, the actual installation command does not enforce that version or identify an immutable artifact. Any future publication under the same package name—or compromise of the package source, maintainer account, distribution registry, or delivery path—could alter the script that receives local code-execution privileges.

Attack Path

  1. An attacker compromises the external package, its publisher account, or its distribution channel, or causes an unsafe release to be published under the expected package name.
  2. The attacker modifies apply-ui.sh or another file that it invokes.
  3. A user runs the unpinned clawhub install agent-token-usage command.
  4. The package manager retrieves the currently available mutable release.
  5. The user executes the installed apply-ui.sh with Bash.
  6. The modified script runs with the user's privileges and may also establish the documented launchd persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user running the Bash command. This may permit access to that user's files, modification of workspace or shell configuration, invocation of locally available credentials, and insta ...[truncated 451 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specific reviewed version rather than installing the latest available release.
  • Verify the downloaded package using a trusted cryptographic signature and an expected SHA-256 or stronger digest before executing any script.
  • Prefer an immutable package reference or content-addressed artifact.
  • Vendor the reviewed installer and launchd configuration into the project when licensing and maintenance requirements permit.
  • Present the script contents or a clear change summary to the user before execution.
  • Avoid instructing users to execute newly downloaded code directly with Bash.
  • Re-audit the external package whenever its pinned version or digest changes.
  • Document the package publisher, trusted distribution source, expected file paths, and integrity-verification procedure.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.