gpu monitor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:51 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a local GPU monitor, but it includes under-disclosed code that can overwrite its own entrypoint file.

Install only if you are comfortable with a local long-running GPU monitor that can read a configured Ollama server.log. Review or remove the create_entry_script self-overwrite function before trusting it in a managed skill environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Session Persistence

Medium

• Category: Rogue Agent

Content

--ollama-log="C:\Users\zugzwang\AppData\Local\Ollama\server.log" \
    --interval=2

# Using config file (create ~/.openclaw/gpu_monitor_config.json)
{
  "update_interval_seconds": 2,
  "ollama_log_path": "/path/to/server.log",

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring says the file only wraps gpu_monitor.py and provides a CLI, but the code also contains logic that rewrites entry.py on disk. This mismatch is security-relevant because it conceals self-modifying behavior from reviewers and users, increasing the chance that file overwrite behavior is missed during deployment or audit.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The function writes directly to entry.py, overwriting the current executable entrypoint without backup, confirmation, or integrity checks. In a skill context, unexpected self-modification can break execution, hide later malicious changes, or be abused to replace trusted code paths, making the package harder to review and safer-operation assumptions invalid.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_gpu_info():
    """获取当前 GPU 显存信息"""
    try:
        result = subprocess.run(
            ['nvidia-smi', '--query-gpu=index,name,memory.total,memory.used,memory.free,persistence_mode,volatile_state,utilization.gpu,temperature.gpu', 
             '--format=csv,noheader'],
            capture_output=True, text=True, timeout=5

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The output example shows Chinese text in the displayed status lines, which suggests the skill may present user-facing output in a specific language. The README does not mention any user opt-in, language selection, or justification for a Chinese-only locale, which can conflict with language/locale policy expectations.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This markdown file states that the skill requires access to Ollama's server.log and parses it for model layer information, but it does not explicitly warn users about the privacy implications of inspecting local logs. Because markdown files should disclose behaviors affecting user data or privacy, a brief warning would improve transparency.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The sample output contains Chinese strings such as '实时模式 - 无层数数据' while the rest of the skill description is in English, and there is no indication that users can choose the display language. This can violate language/locale policy expectations because the skill appears to force a specific language without opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This file includes user- and maintainer-facing natural-language comments and docstrings in Chinese with no indication of language choice or opt-in. Under the language/locale policy, forcing a specific language without offering a user choice can be a policy violation unless clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This file contains user- and maintainer-facing natural language such as the docstring at L051 in Chinese, while the rest of the tool and CLI text are in English. That creates an implicit language constraint without any opt-in or documented locale justification, which matches the language-policy concern for natural-language content.

Static analysis

No suspicious patterns detected.