Security audit

Cost Tracking for Models

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches cost-reporting, but it needs review because it can expose raw session-log error details in Discord-oriented reports and its Node CLI forwards arguments through a shell unsafely.

Review before installing. Use the main cost_report.sh script only with simple trusted flags if you need this functionality, avoid report_discord.sh and --show-errors when session errors may contain private prompts or identifiers, and treat automated Discord delivery as potentially sharing local session-derived data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill exposes shell and environment-driven capabilities but does not declare permissions, which undermines transparency and informed consent for users reviewing what the skill can access. In this context, the skill reads local session logs and invokes shell tooling, so the missing permission declaration can conceal access to potentially sensitive usage data and make security review harder.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A description-behavior mismatch is a security-relevant integrity problem because users may approve the skill based on stated cost-reporting behavior while the implementation performs additional parsing and reporting that was not disclosed. Undisclosed log inspection, error extraction, and feature gaps increase the chance of overbroad data handling and can mislead operators into trusting outputs or access patterns the skill was not authorized for.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The script is presented as a Discord report wrapper, but it also traverses a session directory in the user's home folder and extracts model-specific error details from JSONL logs. That undeclared data access can expose potentially sensitive session metadata or error contents to the report output, especially if those logs contain prompts, identifiers, or operational details not expected in a Discord-facing summary.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill reads local OpenClaw session logs, which may contain sensitive usage metadata, prompts, model names, timestamps, and cost information, but it does not prominently warn users about this privacy impact. Even if access is expected for the feature, omission of a privacy notice reduces user awareness and informed consent around local data processing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script reads from ~/.openclaw/agents/main/sessions and parses per-user session logs without any disclosure, consent prompt, or configuration boundary. In this skill context, the extra output is intended for messaging/reporting, which increases the chance that locally stored session data is surfaced to a wider audience than the operator realizes.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli.js:25