Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because its public description says it summarizes local CodexBar costs, but its code reads OpenClaw OAuth credentials and contacts a Google quota API.
Install only if you intentionally want a Google Antigravity quota checker that can read your OpenClaw auth profile and make authenticated Google API requests. Do not treat it as a local CodexBar cost-summary skill unless the metadata and code are rewritten to remove credential and network access.
scripts/model_usage.py:17Direct extraction and network use of a centrally stored OAuth access token exceeds the Skill's declared local usage scope
This is a strong description-behavior mismatch: the metadata says the skill summarizes local CodexBar cost JSON, while the body describes harvesting OAuth tokens from auth-profiles.json and querying a Google API for live quota data. That mismatch can deceive users and reviewers into authorizing a skill that accesses credentials and external services under a benign pretext, creating a high risk of covert credential misuse or data exfiltration.
The skill promises a narrow, local reporting feature but expands into remote API access using OAuth credentials, which is a materially different and far more sensitive capability. In the context of agent skills, this is especially dangerous because users may invoke it expecting harmless local summarization while it instead touches secrets and external services.
The documentation internally contradicts itself: one part claims local CodexBar JSON processing, while another states the skill reads OAuth tokens and performs Google quota queries. Security-significant inconsistencies like this are dangerous because they obscure the real trust boundary and can cause users to expose credentials without understanding the actual operation.
The skill describes credential access and outbound network activity without clearly warning users, which undermines informed consent for sensitive operations. In this context, the omission is dangerous because the skill is framed as a local usage-summary helper, so users are less likely to expect secret handling or external transmission.
The referenced file is materially unrelated to the declared skill purpose of summarizing local CodexBar per-model usage. Instead, it documents Google Antigravity quota APIs, which creates a dangerous capability mismatch: an agent using this reference could be steered toward remote API interaction, OAuth token handling, and project discovery rather than local cost JSON analysis. In a security review, this kind of off-purpose documentation is high risk because it can enable data exfiltration, unauthorized API use, or prompt/instruction confusion under the guise of a benign local-reporting skill.
The implementation does not match the stated skill purpose. Instead of summarizing local CodexBar usage data, it reads local OpenClaw authentication material and calls a Google endpoint to fetch model quota information, indicating deceptive functionality and unauthorized access to unrelated credentials/services. In a local usage-summary skill, this mismatch is especially suspicious because the networked credential use is unnecessary for the advertised task.
The code accesses credential-bearing auth profiles and uses the extracted bearer token in an authenticated external request, even though the skill is described as a local reporting utility. This creates unnecessary exposure of sensitive credentials and enables actions against external services under the user's identity without informed consent. The mismatch between stated purpose and behavior makes the risk materially worse.
The skill advertises local CodexBar usage summarization but its documented behavior includes reading local authentication material and making outbound requests, yet it declares no explicit tool scope or permission boundaries. In an agent environment, undeclared file-read and network capabilities materially increase the risk of secret access and exfiltration because the operator is not clearly informed of what the skill can touch.
The natural-language instructions and usage examples are presented in Chinese, and there is no indication that users may choose another language. Under the policy, a skill should not impose a language or locale unless it offers opt-in choice or clearly documents a justified regional limitation.
This markdown file includes example invocations, and one of them is a generic natural-language phrase without any product or tool qualifier. Because the phrase does not clearly limit itself to CodexBar or model-usage context, it could cause unintended activation when users ask about unrelated quotas.
Reading OAuth tokens and calling Google internal APIs is not justified by the stated purpose of summarizing local model-usage data, so the documented capability exceeds functional necessity. Unnecessary access to credentials is a classic overprivilege issue that increases the blast radius if the skill is misused, compromised, or invoked unexpectedly.
This documentation adds explicit remote access instructions, including OAuth bearer tokens, Google API scopes, and external endpoints, even though the skill is supposed to summarize local CodexBar usage data. That unjustified expansion of capability increases the chance that an agent will request sensitive tokens, make outbound calls, or access unrelated cloud resources, which is especially dangerous in a local-analysis skill where users would not expect networked behavior.
The script returns status, error, and report text entirely in Chinese, such as '未知', '错误', and 'AI 模型用量报告'. There is no natural-language indication that the locale is configurable or intentionally restricted to a Chinese-speaking context, which can violate language/locale policy requirements.
The script reads a local authentication file, extracts access and project identifiers, and transmits them in an HTTP request without any in-file disclosure or user-facing notice. Even if the token is only placed in an Authorization header rather than the body, the skill silently uses sensitive local credentials for an unrelated remote call, which violates user expectations for a local summary tool.
The code performs an external POST request using local bearer credentials. External transmission is not inherently unsafe, but in this context it is unjustified by the advertised local-only function and therefore increases the chance of silent data/credential misuse and unexpected remote side effects.
}
payload = {"project": project_id}
response = requests.post(url, headers=headers, json=payload, timeout=15)
if response.status_code == 200:
data = response.json()
No suspicious patterns detected.