TokenRanger

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:04 AM UTC
• Version: 1.0.0

Overview

TokenRanger is coherent and not deceptive, but it asks users to install and update unaudited remote components that run persistently and process future conversation history.

Install only if you are comfortable with a third-party persistent local service processing conversation history. Prefer pinned versions, inspect the plugin repository and generated service file before setup, confirm it binds only to localhost unless you intend otherwise, and review uninstall steps so you can disable the background service later.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Installation and Execution of Unverified Third-Party Components

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–83
Vulnerability Type: Supply-chain exposure through externally retrieved plugin, Python dependencies, and model artifacts
Risk Level: Medium

Evidence

bash

openclaw plugins install openclaw-plugin-tokenranger

To pin an exact version:

bash

openclaw plugins install openclaw-plugin-tokenranger@1.0.0 --pin

Step 2 — First-time setup

bash

openclaw tokenranger setup

This pulls Ollama models, creates the Python venv, installs FastAPI/LangChain deps, and registers the sidecar as a system service (systemd on Linux, launchd on macOS).

Technical Analysis

The documented installation process retrieves and executes a third-party npm plugin. Its setup routine subsequently downloads Ollama models, creates a Python environment, and installs additional dependencies. None of the remotely retrieved implementation, dependency lock files, integrity hashes, or model checksums are included in the audited project.

Pinning openclaw-plugin-tokenranger to version 1.0.0 limits changes to the top-level package but does not, by itself, establish artifact integrity or guarantee that all transitive Python and npm dependencies are immutable. The unpinned installation command is presented as the primary installation method.

There is no evidence in SKILL.md that the named package is malicious. The vulnerability is the trust placed in externally maintained and unaudited executable components.

Attack Path

1. An attacker compromises the plugin publishing account, package registry entry, dependency, model source, or another component used during setup.
2. The user follows the documented installation procedure.
3. openclaw plugins install retrieves the affected remote package.
4. openclaw tokenranger setup runs package-controlled setup logic and installs further remote components.
5. The compromised component executes w ...[truncated 604 chars]

Remediation

View remediation

Remediation Suggestions

• Make exact-version installation the default rather than the optional alternative.
• Publish and verify cryptographic hashes or signed provenance for the npm package, Python packages, service code, and model artifacts.
• Supply lock files containing immutable dependency versions and integrity metadata.
• Avoid installing dependencies dynamically during normal execution.
• Display all artifact sources and versions before setup begins and require explicit user approval.
• Audit or vendor the executable plugin and sidecar implementation so their behavior can be reviewed with the Skill.
• Run the sidecar in a restricted environment with minimal filesystem, network, and credential access.
• Document a reproducible installation procedure and verify release signatures before executing setup.

T06 · System Persistence

Warning

• Location: SKILL.md:73

Finding

Persistent User Service Installed by Externally Supplied Setup Logic

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–83
Vulnerability Type: Persistent systemd or launchd service registration
Risk Level: Medium

Evidence

bash

openclaw tokenranger setup

This pulls Ollama models, creates the Python venv, installs FastAPI/LangChain deps, and registers the sidecar as a system service (systemd on Linux, launchd on macOS).

Technical Analysis

The setup procedure registers a long-running sidecar through systemd on Linux or launchd on macOS. Service registration allows the installed component to continue operating across terminal sessions and potentially across login or restart events.

Persistence is disclosed and is consistent with the stated requirement to keep a local compression sidecar available. Therefore, the documentation does not establish malicious persistence or a backdoor. However, the persistent executable and generated service definition are supplied by a third-party implementation that is absent from the audited artifact. A compromise during installation could consequently become persistent under the user's account.

Attack Path

1. A third-party plugin release, setup routine, dependency, or generated service definition is compromised.
2. The user runs openclaw tokenranger setup.
3. The setup process writes a systemd user unit or macOS LaunchAgent referencing attacker-controlled code.
4. The service is enabled or loaded.
5. The affected code runs beyond the original setup session and may restart automatically under the user's account.

Impact Assessment

A compromised service could repeatedly execute code with the service account's permissions, access files and credentials available to that account, communicate over permitted network interfaces, and process or capture conversation history sent to the compression endpoint.

The available documentation indicates user-level persistence, including a systemd user unit and a per-user m ...[truncated 80 chars]

Remediation

View remediation

Remediation Suggestions

• Require separate, explicit confirmation before installing or enabling a persistent service.
• Show the complete generated service definition, executable path, arguments, environment variables, and working directory before registration.
• Verify the integrity and provenance of every executable referenced by the service.
• Use a dedicated, least-privileged service account or an equivalent sandbox where supported.
• Apply systemd hardening controls such as NoNewPrivileges, filesystem restrictions, private temporary directories, and narrowly scoped network access.
• Restrict the sidecar listener to the loopback interface and require authentication if remote service URLs are supported.
• Ensure uninstall removes the service definition, disables the service, terminates running processes, and removes no unrelated user data.
• Document how users can inspect, disable, and remove persistence before installation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:137

Finding

Mutable Update Procedure Re-executes Third-Party Setup

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 137–154
Vulnerability Type: Unverified update of a persistent third-party component
Risk Level: Medium

Evidence

bash

# Check for updates (dry run)
openclaw plugins update tokenranger --dry-run

# Apply update
openclaw plugins update tokenranger
openclaw tokenranger setup   # re-runs setup if sidecar deps changed
openclaw gateway restart

To pin a specific version:

bash

openclaw plugins install openclaw-plugin-tokenranger@2026.3.1 --pin
openclaw tokenranger setup
openclaw gateway restart

List all published versions:

bash

npm view openclaw-plugin-tokenranger versions --json

Technical Analysis

The primary update workflow installs the latest available plugin release and reruns its setup routine. The documentation does not require signature, checksum, provenance, or dependency-lock verification before the new code is installed and permitted to modify the sidecar environment.

A pinned alternative is documented, but selecting a version by name is not equivalent to validating the integrity or trustworthiness of its contents. Because setup may update dependencies and persistent service components, a compromised release can affect both immediate execution and subsequent service starts.

Attack Path

1. An attacker compromises a future plugin release, package publishing account, registry distribution path, or transitive dependency.
2. The user runs the documented dry run, which reports an available update but does not establish artifact integrity.
3. The user executes openclaw plugins update tokenranger.
4. The mutable remote release is downloaded and installed.
5. openclaw tokenranger setup executes updated setup logic and may replace sidecar dependencies or service components.
6. The compromised implementation executes immediately or on later service starts.

Impact Assessment

Exploitat ...[truncated 467 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mutable latest-version updates with an approved-version workflow.
• Verify signed release provenance and cryptographic hashes before installation.
• Pin all npm and Python transitive dependencies using integrity-bearing lock files.
• Present release notes, dependency changes, service-definition changes, and setup changes before applying an update.
• Separate package download and verification from execution.
• Require explicit authorization before rerunning setup or changing the persistent service.
• Support rollback to a previously verified package and service configuration.
• Perform updates in a restricted staging environment before promoting them to the active installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

User message → OpenClaw gateway
  → before_agent_start hook
  → Turn 1: skip (full fidelity)
  → Turn 2+: send history to localhost:8100/compress
  → FastAPI sidecar runs LangChain LCEL chain via Ollama
  → Compressed summary prepended to context
  → Cloud LLM receives compressed context instead of full history

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

bash

# Linux
systemctl --user stop tokenranger && systemctl --user disable tokenranger
rm ~/.config/systemd/user/tokenranger.service

# macOS
launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

macOS

launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist rm ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist

text

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation guidance is broad enough that the skill may be loaded in many token-cost or compression-related conversations, increasing the chance an agent follows installation or configuration instructions without the user explicitly requesting this specific plugin. That expands the attack surface because the skill includes operational steps that modify local services and route conversation history through a sidecar.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructions perform meaningful system changes: pulling models, creating a Python environment, installing dependencies, and registering a persistent service. Without an explicit warning and confirmation step, an agent could guide users into making durable local changes they may not understand, including automatic processing of future conversation history by the sidecar.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

rm ~/.config/systemd/user/tokenranger.service

macOS

launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist rm ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

rm ~/.config/systemd/user/tokenranger.service

macOS

launchctl unload ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist rm ~/Library/LaunchAgents/com.peterjohannmedina.tokenranger.plist

text

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The uninstall section includes commands that stop services and delete service definition files with rm, which are system-modifying actions. Although the intent is uninstall-related, the markdown does not explicitly warn that these commands permanently remove launchd/systemd configuration and should be used only when the user intends full removal.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.