Security audit

Ag Model Usage

Security checks across malware telemetry and agentic risk

Overview

This skill is framed as local usage reporting but actually reads a stored Google Antigravity OAuth token and uses it for remote quota queries.

Install only if you intentionally want this skill to use your local Google Antigravity/OpenClaw OAuth profile to query Google quota data. Do not treat it as a local CodexBar cost-summary skill; it should be renamed, re-described, and gated by explicit consent before handling stored credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill advertises a local CodexBar usage-summary function but declares behavior requiring file reads and network access without corresponding permission disclosure. In context, the documentation explicitly says it reads OAuth tokens and contacts a Google internal API, so the missing permission declaration conceals credential access and exfiltration-capable behavior from users and policy checks.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a strong description-behavior mismatch: the manifest claims local analysis of CodexBar cost JSON, while the body describes reading auth-profiles.json, reusing OAuth tokens, and querying a Google internal endpoint for quota data. Such mismatch is dangerous because it can trick users and automated tooling into approving a skill under false pretenses while it accesses sensitive credentials and performs unrelated remote account inspection.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documentation openly states that the skill uses OAuth tokens to query Google internal APIs, which directly contradicts the manifest's harmless-sounding local CodexBar summary purpose. This inconsistency increases danger because the real behavior involves sensitive credential handling and remote requests that a user would not reasonably expect from the declared skill type.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill claims to summarize local CodexBar per-model cost data, but the actual documentation describes inspecting remote Google-linked account quotas and model availability. In this context, the mismatch is especially dangerous because it masks a credential-backed account-querying workflow as a simple local reporting utility.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Introducing OAuth token reads and remote Google API access is unjustified for a local CodexBar usage-summary skill and materially expands the attack surface. Because token access can enable unauthorized account queries and possible further abuse, this capability creep is a security-significant violation rather than a harmless documentation issue.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The reference file is materially inconsistent with the skill's stated purpose: instead of documenting local CodexBar per-model usage/cost processing, it provides remote Google API endpoints, OAuth scopes, bearer-token authentication, and quota response details. In an agent setting, this kind of mismatched reference can misdirect the model into making unauthorized external requests, handling access tokens, or exposing unrelated cloud project data, which meaningfully expands the skill's security and privacy risk surface.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill advertises local CodexBar per-model usage summarization, but instead reads a local authentication file and queries a remote Google API for model quota data. This mismatch is dangerous because it can trick users into authorizing unexpected credential access and remote data transmission under false pretenses, which is a strong indicator of deceptive behavior.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code loads a local access token from ~/.openclaw/.../auth-profiles.json and uses it in an authenticated outbound request, even though the skill's stated purpose does not require network access. Using local credentials for an unrelated remote API expands the attack surface, risks unauthorized account/project actions or metadata disclosure, and indicates capability beyond user expectations.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The function and output claim to provide model usage reporting, but the implementation actually reports remote quota availability for a hardcoded set of models. This deceptive or misleading behavior can cause users to trust incorrect reporting while masking unauthorized remote activity and credential use.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad enough to match ordinary user requests such as checking usage or quota, making accidental invocation more likely. In this case that matters because invoking the skill could lead to unexpected credential-file reads and network requests, so overbroad activation materially increases risk.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill describes reading OAuth tokens and sending quota queries without warning the user that credentials will be accessed and network activity will occur. That omission undermines informed consent and can enable covert use of local tokens for unintended account inspection or data transmission.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script accesses a local authentication file and transmits a bearer token in an HTTP Authorization header without any user-facing warning, consent, or disclosure. Silent secret use is dangerous because users cannot assess the trust boundary, destination, or consequences of exposing credentials to remote services.

Ssd 2

High

Confidence: 99% confidence
Finding: The skill explicitly describes reusing OAuth tokens from a local profile file to impersonate an official client for quota queries. This is highly dangerous because it normalizes credential theft/reuse and unauthorized client impersonation, which can violate account boundaries, evade user expectations, and facilitate broader abuse of the user's authenticated session.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.