Usage Visualizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:10 PM UTC
• Version: 1.1.3

Overview

This skill mostly matches its usage-reporting purpose, but it needs review because its local/no-network claims are stronger than the code supports.

Review before installing if you need a strict no-network or high-assurance privacy posture. Use a dedicated virtual environment, set OPENCLAW_WORKSPACE to a directory you control, and be aware that the skill scans local OpenClaw/Clawdbot session logs and maintains a local usage database. The publisher should pin dependencies, narrow the zero-network/audit claims, and escape or validate all log-derived HTML before Chromium rendering.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/html_report.py:148

Finding

Unescaped Session Metadata Allows Active HTML Injection in the Chromium Report Renderer

Content

View full analysis

0 else 0 u_cost = (cost / tokens * 1000000) if tokens > 0 else 0 html += f"""

{m[:18]}{fmt_tokens(tokens)}

Unit Cost: ${u_cost:.2f}/MCost: {fmt_cost(cost)}

""" ``` `scripts/generate_report_image.py:67-80` writes and opens the resulting document in Chromium: ```python # Save HTML with open(html_path, "w", encoding="utf-8") as f: f.write(html) print(f"HTML saved to {html_path}") # Generate image with html2image hti = Html2Image() hti.output_path = str(output_dir) # High-resolution PPT viewport (1440p style ratio, increased height for safety) hti.size = (1200, 1000) hti.scree ...[truncated 2781 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Open-Ended Dependency Versions Make Installation Non-Reproducible

Content

View full analysis

=6.0 html2image>=2.0.0 Pillow>=10.0.0 ``` `SKILL.md:14-17` instructs the platform to install those dependencies: ```yaml install: - id: pip-deps kind: exec command: "pip3 install -r requirements.txt" label: "Install Python dependencies" ``` ### Technical Analysis The dependency specifications permit pip to select any future compatible release. Consequently, the installed code is not necessarily the code that existed when this Skill version was reviewed. Python package installation and import can execute package-controlled code under the installing user's privileges. If a dependency account, release process, distribution artifact, or dependency chain is compromised, the installation command could introduce behavior that was absent during this audit. The reviewed package names appear legitimate, and the repository does not specify an untrusted package index or an apparent typosquatted package. Therefore, this is a supply-chain hardening issue rather than evidence that the current dependencies are malicious. ### Attack Path 1. A future version or transitive dependency of one of the permitted packages is compromised or publishes unsafe behavior. 2. A user or agent installs the Skill dependencies using the documented command. 3. Because the requirements contain open-ended lower bounds, pip resolves the compromised or otherwise unreviewed release. 4. Package-controlled installation or runtime code executes with the privileges of the user running pip or the Skill. 5. The malicious dependency can access files, environment variables, or network resources available to that process. ### Impact Assessment The maximum impact is determined by the privileges of the installati ...[truncated 518 chars]

Remediation

View remediation

html2image== Pillow== ``` 2. Generate a lock file that includes all transitive dependencies. 3. Record SHA-256 hashes for every distribution and install with pip's `--require-hashes` option. 4. Review dependency updates before changing the lock file, including release notes, ownership changes, and known vulnerability advisories. 5. Install dependencies in a dedicated virtual environment rather than the user's global Python environment. 6. Use a trusted, explicitly configured package index and avoid unexpected fallback indexes. 7. Consider removing `PyYAML` if it is not needed at runtime; `report.py` imports it but does not use it in the reviewed code. Reducing dependencies decreases supply-chain exposure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Security-marketing claims such as 'audit-verified privacy' without technical substantiation are dangerous because they can induce misplaced trust and relaxed review. In an agent-executed skill, unsupported assurance language increases the likelihood that users permit access to logs or local files under false assumptions about how data is handled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Security-marketing claims such as 'audit-verified privacy' without technical substantiation are dangerous because they can induce misplaced trust and relaxed review. In an agent-executed skill, unsupported assurance language increases the likelihood that users permit access to logs or local files under false assumptions about how data is handled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

Security-marketing claims such as 'audit-verified privacy' without technical substantiation are dangerous because they can induce misplaced trust and relaxed review. In an agent-executed skill, unsupported assurance language increases the likelihood that users permit access to logs or local files under false assumptions about how data is handled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

Security-marketing claims such as 'audit-verified privacy' without technical substantiation are dangerous because they can induce misplaced trust and relaxed review. In an agent-executed skill, unsupported assurance language increases the likelihood that users permit access to logs or local files under false assumptions about how data is handled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Security-marketing claims such as 'audit-verified privacy' without technical substantiation are dangerous because they can induce misplaced trust and relaxed review. In an agent-executed skill, unsupported assurance language increases the likelihood that users permit access to logs or local files under false assumptions about how data is handled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Security-marketing claims such as 'audit-verified privacy' without technical substantiation are dangerous because they can induce misplaced trust and relaxed review. In an agent-executed skill, unsupported assurance language increases the likelihood that users permit access to logs or local files under false assumptions about how data is handled.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares executable installation and runtime commands plus environment and filesystem usage, but does not define any explicit tool scope or permissions boundary. That increases the chance an agent will run shell/file operations with broader access than users expect, especially because the skill also makes strong safety/privacy claims that may reduce scrutiny.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims zero network dependencies, but the install step runs 'pip3 install -r requirements.txt', which normally retrieves packages from the network. This inconsistency matters because network access changes the trust model, introduces supply-chain risk, and contradicts the user's expectation of fully local operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as providing usage statistics and visual reporting, which suggests analytics over local data. In this file, the code not only fetches/parses session logs but also clears existing records and persists normalized usage data via UsageStore, making it a data-ingestion and storage-modification component rather than just visualization/reporting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code clears stored usage records and then writes newly parsed records into persistent storage, but it provides no visible confirmation prompt, print/log disclosure, or other user-facing warning in this file. Because these operations modify local user data and can remove prior records, they meet the missing-disclosure criteria for code files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/report.py (reported line 56)May include surrounding context.

python

def calc_cache_savings(tokens_summary: dict) -> dict:
    """Calculate cache savings - how much saved with 90% discount on cache reads"""
    cache_read = tokens_summary.get("cache_read_tokens", 0)
    cache_write = tokens_summary.get("cache_creation_tokens", 0)
    
    if cache_read == 0 and cache_write == 0:
        return {"read_savings": 0, "write_cost": 0, "total_savings": 0}

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The docstring presents the tool as a simple one-step reporting runner, but the implementation automatically launches a fetch/sync subprocess unless disabled. In the context of a skill marketed as local and privacy-audited, this hidden default behavior increases the risk of unauthorized or surprising external interaction and can mislead operators about the tool's actual data flow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill metadata and description emphasize local-only, privacy-preserving reporting, but the runner performs a fetch/sync by default unless the user explicitly opts out. In a security-sensitive agent context, this mismatch can cause unexpected network access and data transfer, undermining user trust and potentially exposing usage telemetry contrary to expectations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_usage_report.py (reported line 19)May include surrounding context.

python

def run(cmd):
    result = subprocess.run(cmd, cwd=BASE_DIR, text=True, capture_output=True)
    if result.returncode != 0:
        return False, result.stdout.strip(), result.stderr.strip()
    return True, result.stdout.strip(), result.stderr.strip()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The clear_records method performs DELETE operations, including unconditional deletion of all records when no filters are provided, but it provides no confirmation prompt or user-facing warning. The docstring is minimal and does not disclose that calling the method with no arguments erases the entire usage_records table.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The user-facing output strings are fixed in Chinese (e.g. the report title and labels), which enforces a specific language regardless of user preference. This matches the policy category for language or locale constraints without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The manifest advertises 'Audit-verified privacy (No credentials stored)', yet the skill requires the OPENCLAW_WORKSPACE environment variable. While this variable is not necessarily a credential, the blanket privacy claim is broader than what the file substantiates and may mislead users about external state dependencies.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only (pyyaml>=6.0), so installs are not reproducible and may resolve to different versions over time. This increases supply-chain risk and makes it difficult to verify whether a deployed version includes known security fixes or introduces a vulnerable release through future updates.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pyyaml>=6.0
html2image>=2.0.0
Pillow>=10.0.0

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

PyYAML has multiple historical advisories, and because the manifest does not pin a specific version, it is impossible to confirm from this file alone whether the installed release is affected. In a skill that likely processes local configuration or report data, unsafe YAML handling combined with an affected version could lead to input-validation or deserialization-related risk if untrusted YAML is ever parsed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

html2image>=2.0.0 is unpinned, which allows non-deterministic installs and expands the attack surface to future package releases without review. In a rendering/HTML-to-image package, unexpected dependency changes can also affect the security posture of any browser or rendering components it invokes.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pyyaml>=6.0
html2image>=2.0.0
Pillow>=10.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Pillow>=10.0.0 is not pinned to a specific release, so builds may consume different versions across environments or over time. For an image-processing library with a history of security advisories, this weakens assurance that only reviewed and fixed versions are installed.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pyyaml>=6.0
html2image>=2.0.0
Pillow>=10.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Pillow has numerous past advisories, and the unpinned requirement prevents verification that deployed environments will use a patched release. Given this skill performs visual reporting and likely handles images, using an unverified Pillow version could expose the skill to image parsing or resource-consumption issues if crafted inputs are processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code file defines a helper that writes arbitrary pricing data to a caller-specified filepath, but the function has no user-facing print/log message, confirmation prompt, or warning comment describing that it will overwrite/create a file. For code files, file writes are safety-relevant operations when there is no visible disclosure at the point of action.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The top-level documentation emphasizes strictly local behavior, but the script consults the OPENCLAW_WORKSPACE environment variable to determine storage location. Reading process environment is not the same as purely file-local processing, so the docstring overstates the implementation's constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script scans ~/.openclaw and ~/.clawdbot session files and parses their contents, which may contain user activity metadata. Aside from the brief module docstring, there is no runtime warning, prompt, or explicit disclosure to the user that these local session logs will be accessed and processed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.