Agent Token Usage

• Outcome: Pass
• Latest audit: Jun 23, 2026 · 1:33 PM UTC
• Version: 0.3.0

Overview

This skill locally reports OpenClaw agent token usage, with an optional UI patch that is disclosed but should be used only if you accept a macOS background refresh job.

The CLI portion is appropriate for local token summaries. Run apply-ui.sh only if you are comfortable modifying your local OpenClaw Control UI and, on macOS, installing a LaunchAgent that refreshes token data every 5 minutes. Use remove-ui.sh to undo the UI patch and remove the background job.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script's stated purpose is optional UI patching, but it also creates and loads a persistent macOS LaunchAgent that runs every 5 minutes. That persistence expands the trust boundary from a one-time local modification to recurring code execution, which is risky because it is installed automatically and is not clearly disclosed up front.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The header comments present the script as an optional UI injector, which understates its actual behavior because it also modifies user startup configuration on macOS. Misleading framing is dangerous in security-sensitive tooling because users may consent to a cosmetic change without realizing they are authorizing persistent background execution.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script installs a launchd job without prompting the user or requiring an explicit opt-in flag. Silent persistence is a common abuse pattern because it allows recurring execution beyond the user's immediate action and may survive across sessions without their awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

</plist>
EOF
  launchctl unload "$PLIST" 2>/dev/null || true
  launchctl load "$PLIST" && green "✓ launchd job installed (refreshes every 5min): $LABEL"
fi

dim "  Refresh your Control UI tab. 📊 button appears next to Search."

• Confidence: 99% confidence
• Finding: launchctl load "$PLIST" && green "✓ launchd job install

Session Persistence

Medium

• Category: Rogue Agent

Content

if [[ "$OSTYPE" == "darwin"* ]]; then
  LABEL="com.symbolstar.openclaw.token-usage-refresh"
  PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
  mkdir -p "$HOME/Library/LaunchAgents" "$HOME/.openclaw/logs"
  cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 90% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

if [[ "$OSTYPE" == "darwin"* ]]; then
  LABEL="com.symbolstar.openclaw.token-usage-refresh"
  PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
  mkdir -p "$HOME/Library/LaunchAgents" "$HOME/.openclaw/logs"
  cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 90% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

LABEL="com.symbolstar.openclaw.token-usage-refresh"
  PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
  mkdir -p "$HOME/Library/LaunchAgents" "$HOME/.openclaw/logs"
  cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 94% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$HOME/Library/LaunchAgents" "$HOME/.openclaw/logs"
  cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>$LABEL</string>

• Confidence: 88% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$HOME/Library/LaunchAgents" "$HOME/.openclaw/logs"
  cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>$LABEL</string>

• Confidence: 88% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>$LABEL</string>
  <key>ProgramArguments</key>

• Confidence: 94% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

</plist>
EOF
  launchctl unload "$PLIST" 2>/dev/null || true
  launchctl load "$PLIST" && green "✓ launchd job installed (refreshes every 5min): $LABEL"
fi

dim "  Refresh your Control UI tab. 📊 button appears next to Search."

• Confidence: 99% confidence
• Finding: launchctl load

Session Persistence

Medium

• Category: Rogue Agent

Content

</plist>
EOF
  launchctl unload "$PLIST" 2>/dev/null || true
  launchctl load "$PLIST" && green "✓ launchd job installed (refreshes every 5min): $LABEL"
fi

dim "  Refresh your Control UI tab. 📊 button appears next to Search."

• Confidence: 99% confidence
• Finding: PLIST

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.