T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:57- Finding
Unprotected Destructive Deletion of Aged Workspace Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Token Cost Optimizer
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for OpenClaw cost tuning, but it gives broad activation guidance and unsafe cleanup instructions that could delete workspace and memory data without safeguards.
Review this skill before installing. Its diagnostics and model-cost advice are reasonable, but do not run the cleanup commands as written; first list candidate files, make backups, and explicitly choose what to remove. Also verify any changes to openclaw.json or soul.md because they can persistently alter OpenClaw behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation text is excessively broad and includes generic phrases like '帮我省钱', '优化配置', and '检查一下有没有浪费', which could trigger the skill during ordinary conversation unrelated to safe cost optimization workflows. Over-broad auto-activation increases the chance that users are steered into running diagnostic or cleanup commands unnecessarily, expanding the blast radius of the skill's later operational guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill recommends destructive deletion actions like 'find ~/.openclaw/workspace -mtime +30 -type f -delete' and deletion of old memory/skill data without prominent warnings, dry-run steps, or backup guidance. In a cost-optimization skill, users are more likely to follow cleanup advice quickly, so missing safeguards can lead to accidental loss of important state, work artifacts, or long-term memory that may be expensive or impossible to reconstruct.
- Content
Static analysis
No suspicious patterns detected.