Token Usage Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:24 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent token-usage tracker, but its local storage implementation is unsafe enough that users should review it before installing.

Install only if you are comfortable with persistent local usage logs. Before using it, fix or review the data-file handling so '~' is expanded to the intended home directory, storage is restricted to a dedicated directory, symlink writes are avoided, and the usage log has appropriate permissions and retention expectations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/token_usage_tracker.py:13

Finding

Unsafe Local Data-File Path Handling Enables Symlink-Directed File Overwrite

Content

View full analysis

Dict: """Load token usage data from file""" try: with open(self.data_file, 'r') as f: return json.load(f) except FileNotFoundError: return { "sessions": {}, "daily_totals": {}, "thresholds": {}, "model_pricing": { "gpt-4": 0.03 / 1000, "gpt-3.5-turbo": 0.0015 / 1000, "claude-2": 0.0110 / 1000, "doubao-seed": 0.002 / 1000 } } def _save_data(self): """Save token usage data to file""" import os os.makedirs(os.path.dirname(self.data_file), exist_ok=True) with open(self.data_file, 'w') as f: json.dump(self.usage_data, f, indent=2) ``` ### Technical Analysis The default data path contains `~`, but Python's `open()` and `os.makedirs()` functions do not automatically expand this notation. Consequently, the default path is interpreted relative to the current working directory as `./~/.openclaw/token_usage.json`, rather than as a file beneath the executing user's home directory. The save operation also opens the destination with mode `w` without checking whether the destination is a symbolic link. If an attacker can prepare the relative path in the process's working directory, the attacker can place a symbolic link at the expected destination. The subsequent save will follow that link and truncate or replace any linked file that i ...[truncated 1737 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/token_usage_tracker.py:40

Finding

Negative Token Counts Permit Usage Accounting and Threshold-Alert Bypass

Content

View full analysis

Remediation

View remediation

None: if isinstance(value, bool) or not isinstance(value, int): raise TypeError(f"{name} must be an integer") if value < 0: raise ValueError(f"{name} must be non-negative") ``` 2. Invoke validation inside `track_usage()` so that every caller is protected, rather than relying only on command-line validation. 3. Replace truthiness-based required-argument checks with explicit `None` checks: ```python if args.model is None or args.prompt_tokens is None or args.completion_tokens is None: parser.error("--track requires --model, --prompt-tokens, and --completion-tokens") ``` 4. Validate loaded JSON records before using them in totals or cost calculations. 5. Consider setting an upper bound based on expected provider limits to reduce accidental corruption. 6. If accounting integrity is important, record immutable usage events and derive totals from validated events rather than directly mutating aggregate counters. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises or implies code that reads and writes local files, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may execute file-capable resources without explicit user-visible constraints, increasing the risk of unintended filesystem access or persistence.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill explicitly describes persistent storage of usage data in ~/.openclaw/token_usage.json, which introduces session persistence on the local machine. Even though the stated purpose is benign, persistent files can accumulate potentially sensitive metadata about model usage patterns and may be read, modified, or retained longer than intended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

### scripts/

Create only the resource directories this skill actually needs. Delete this section if no resources are required.

### scripts/
- `token_usage_tracker.py`: Main script for tracking and reporting token usage

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/integration_guide.md (reported line 140)May include surrounding context.

Permission Issues

If you encounter permission errors when writing to the data file, ensure the OpenClaw user has write access to the ~/.openclaw/ directory:

bash

chown -R $USER:$USER ~/.openclaw/

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file advertises alert channels including email and webhook, which can send token-usage or model-usage information off-system. The README does not include any user warning about possible data transmission, privacy considerations, or the need to review what telemetry is included in alerts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README instructs users to integrate automatic tracking by extracting token metadata and recording it with a session identifier. For a markdown file, this affects user data/privacy behavior, but the description does not warn that usage telemetry tied to sessions may be retained or analyzed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.