TokenRanger

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:04 AM UTC
• Version: 1.0.0

Overview

TokenRanger is coherent and not deceptive, but it asks users to install and update unaudited remote components that run persistently and process future conversation history.

Install only if you are comfortable with a third-party persistent local service processing conversation history. Prefer pinned versions, inspect the plugin repository and generated service file before setup, confirm it binds only to localhost unless you intend otherwise, and review uninstall steps so you can disable the background service later.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62
• Finding: Installation and Execution of Unverified Third-Party Components## Vulnerability Details **File Location**: `SKILL.md`, lines 62–83 **Vulnerability Type**: Supply-chain exposure through externally retrieved plugin, Python dependencies, and model artifacts **Risk Level**: Medium ### Evidence ```bash openclaw plugins install openclaw-plugin-tokenranger ``` To pin an exact version: ```bash openclaw plugins install openclaw-plugin-tokenranger@1.0.0 --pin ``` ### Step 2 — First-time setup ```bash openclaw tokenranger setup ``` This pulls Ollama models, creates the Python venv, installs FastAPI/LangChain deps, and registers the sidecar as a system service (systemd on Linux, launchd on macOS). ### Technical Analysis The documented installation process retrieves and executes a third-party npm plugin. Its setup routine subsequently downloads Ollama models, creates a Python environment, and installs additional dependencies. None of the remotely retrieved implementation, dependency lock files, integrity hashes, or model checksums are included in the audited project. Pinning `openclaw-plugin-tokenranger` to version `1.0.0` limits changes to the top-level package but does not, by itself, establish artifact integrity or guarantee that all transitive Python and npm dependencies are immutable. The unpinned installation command is presented as the primary installation method. There is no evidence in `SKILL.md` that the named package is malicious. The vulnerability is the trust placed in externally maintained and unaudited executable components. ### Attack Path 1. An attacker compromises the plugin publishing account, package registry entry, dependency, model source, or another component used during setup. 2. The user follows the documented installation procedure. 3. `openclaw plugins install` retrieves the affected remote package. 4. `openclaw tokenranger setup` runs package-controlled setup logic and installs further remote components. 5. The compromised component executes w ...[truncated 604 chars]
• Remediation: ## Remediation Suggestions - Make exact-version installation the default rather than the optional alternative. - Publish and verify cryptographic hashes or signed provenance for the npm package, Python packages, service code, and model artifacts. - Supply lock files containing immutable dependency versions and integrity metadata. - Avoid installing dependencies dynamically during normal execution. - Display all artifact sources and versions before setup begins and require explicit user approval. - Audit or vendor the executable plugin and sidecar implementation so their behavior can be reviewed with the Skill. - Run the sidecar in a restricted environment with minimal filesystem, network, and credential access. - Document a reproducible installation procedure and verify release signatures before executing setup.

T06 · System Persistence

Warning

• Location: SKILL.md:73
• Finding: Persistent User Service Installed by Externally Supplied Setup Logic## Vulnerability Details **File Location**: `SKILL.md`, lines 73–83 **Vulnerability Type**: Persistent systemd or launchd service registration **Risk Level**: Medium ### Evidence ```bash openclaw tokenranger setup ``` This pulls Ollama models, creates the Python venv, installs FastAPI/LangChain deps, and registers the sidecar as a system service (systemd on Linux, launchd on macOS). ### Technical Analysis The setup procedure registers a long-running sidecar through systemd on Linux or launchd on macOS. Service registration allows the installed component to continue operating across terminal sessions and potentially across login or restart events. Persistence is disclosed and is consistent with the stated requirement to keep a local compression sidecar available. Therefore, the documentation does not establish malicious persistence or a backdoor. However, the persistent executable and generated service definition are supplied by a third-party implementation that is absent from the audited artifact. A compromise during installation could consequently become persistent under the user's account. ### Attack Path 1. A third-party plugin release, setup routine, dependency, or generated service definition is compromised. 2. The user runs `openclaw tokenranger setup`. 3. The setup process writes a systemd user unit or macOS LaunchAgent referencing attacker-controlled code. 4. The service is enabled or loaded. 5. The affected code runs beyond the original setup session and may restart automatically under the user's account. ### Impact Assessment A compromised service could repeatedly execute code with the service account's permissions, access files and credentials available to that account, communicate over permitted network interfaces, and process or capture conversation history sent to the compression endpoint. The available documentation indicates user-level persistence, including a systemd user unit and a per-user m ...[truncated 80 chars]
• Remediation: ## Remediation Suggestions - Require separate, explicit confirmation before installing or enabling a persistent service. - Show the complete generated service definition, executable path, arguments, environment variables, and working directory before registration. - Verify the integrity and provenance of every executable referenced by the service. - Use a dedicated, least-privileged service account or an equivalent sandbox where supported. - Apply systemd hardening controls such as `NoNewPrivileges`, filesystem restrictions, private temporary directories, and narrowly scoped network access. - Restrict the sidecar listener to the loopback interface and require authentication if remote service URLs are supported. - Ensure uninstall removes the service definition, disables the service, terminates running processes, and removes no unrelated user data. - Document how users can inspect, disable, and remove persistence before installation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:137
• Finding: Mutable Update Procedure Re-executes Third-Party Setup## Vulnerability Details **File Location**: `SKILL.md`, lines 137–154 **Vulnerability Type**: Unverified update of a persistent third-party component **Risk Level**: Medium ### Evidence ```bash # Check for updates (dry run) openclaw plugins update tokenranger --dry-run # Apply update openclaw plugins update tokenranger openclaw tokenranger setup # re-runs setup if sidecar deps changed openclaw gateway restart ``` To pin a specific version: ```bash openclaw plugins install openclaw-plugin-tokenranger@2026.3.1 --pin openclaw tokenranger setup openclaw gateway restart ``` List all published versions: ```bash npm view openclaw-plugin-tokenranger versions --json ``` ### Technical Analysis The primary update workflow installs the latest available plugin release and reruns its setup routine. The documentation does not require signature, checksum, provenance, or dependency-lock verification before the new code is installed and permitted to modify the sidecar environment. A pinned alternative is documented, but selecting a version by name is not equivalent to validating the integrity or trustworthiness of its contents. Because setup may update dependencies and persistent service components, a compromised release can affect both immediate execution and subsequent service starts. ### Attack Path 1. An attacker compromises a future plugin release, package publishing account, registry distribution path, or transitive dependency. 2. The user runs the documented dry run, which reports an available update but does not establish artifact integrity. 3. The user executes `openclaw plugins update tokenranger`. 4. The mutable remote release is downloaded and installed. 5. `openclaw tokenranger setup` executes updated setup logic and may replace sidecar dependencies or service components. 6. The compromised implementation executes immediately or on later service starts. ### Impact Assessment Exploitat ...[truncated 467 chars]
• Remediation: ## Remediation Suggestions - Replace mutable latest-version updates with an approved-version workflow. - Verify signed release provenance and cryptographic hashes before installation. - Pin all npm and Python transitive dependencies using integrity-bearing lock files. - Present release notes, dependency changes, service-definition changes, and setup changes before applying an update. - Separate package download and verification from execution. - Require explicit authorization before rerunning setup or changing the persistent service. - Support rollback to a previously verified package and service configuration. - Perform updates in a restricted staging environment before promoting them to the active installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection

Content

User message → OpenClaw gateway
  → before_agent_start hook
  → Turn 1: skip (full fidelity)
  → Turn 2+: send history to localhost:8100/compress
  → FastAPI sidecar runs LangChain LCEL chain via Ollama
  → Compressed summary prepended to context
  → Cloud LLM receives compressed context instead of full history

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Linux
systemctl --user stop tokenranger && systemctl --user disable tokenranger
rm ~/.config/systemd/user/tokenranger.service

# macOS
launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# macOS
launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist
rm ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist
```

---

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation guidance is broad enough that the skill may be loaded in many token-cost or compression-related conversations, increasing the chance an agent follows installation or configuration instructions without the user explicitly requesting this specific plugin. That expands the attack surface because the skill includes operational steps that modify local services and route conversation history through a sidecar.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions perform meaningful system changes: pulling models, creating a Python environment, installing dependencies, and registering a persistent service. Without an explicit warning and confirmation step, an agent could guide users into making durable local changes they may not understand, including automatic processing of future conversation history by the sidecar.

Session Persistence

Medium

• Category: Rogue Agent

Content

rm ~/.config/systemd/user/tokenranger.service

# macOS
launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist
rm ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist
```

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

rm ~/.config/systemd/user/tokenranger.service

# macOS
launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist
rm ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist
```

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The uninstall section includes commands that stop services and delete service definition files with `rm`, which are system-modifying actions. Although the intent is uninstall-related, the markdown does not explicitly warn that these commands permanently remove launchd/systemd configuration and should be used only when the user intends full removal.

Static analysis

No suspicious patterns detected.