ClawMetry

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.1.0

Overview

This observability skill is not overtly malicious, but it needs review because it collects and can sync highly sensitive agent transcripts, memory, tool data, and logs.

Install only if you are comfortable with ClawMetry aggregating agent conversations, memory files, tool inputs/results, logs, and channel metadata. Treat the local dashboard as sensitive, protect local access, and enable cloud sync only if you trust the external binary and service with encrypted telemetry and API-key based access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:25

Finding

Excessive Access to Sensitive Agent Telemetry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25-30, 45-55
Vulnerability Type: Excessive access to sensitive agent data
Risk Level: Medium

Evidence

markdown

- **Sessions** — per-session token/cost breakdown, transcript viewer
- **Brain** — live feed of every LLM call with model, tokens, and latency
- **Flow** — animated architecture diagram showing real-time tool calls
- **Memory** — workspace memory file viewer (MEMORY.md, SOUL.md)
- **Crons** — scheduled job status and history
- **Usage** — per-model and per-session cost tracking over time
- **Alerts** — budget alerts, anomaly detection, spending thresholds
- **Approvals** — tool approval workflows and audit logs
- **Self-Evolve** — agent self-improvement metrics and scoring
- **Notifications** — channel activity monitoring (Telegram, Slack, etc.)

markdown

## Data collected

ClawMetry observes diagnostic events from the OpenClaw runtime:

- **Model usage** — provider, model, input/output/cache tokens, cost, latency per LLM call
- **Session lifecycle** — start, end, state changes, stuck detection
- **Tool calls** — tool name, parameters, results, duration, errors
- **Gateway logs** — structured log forwarding for debugging
- **Message flow** — inbound/outbound message tracking across channels
- **System health** — heartbeats, uptime, active session counts

Technical Analysis

The declared observability scope extends beyond aggregate cost and health metrics. It includes conversation transcripts, agent memory files, complete tool parameters and results, gateway logs, LLM activity, and cross-channel message activity. These data sources can contain credentials, authentication tokens, personal information, private prompts, file contents, and operational secrets.

Access to MEMORY.md, SOUL.md, transcripts, and tool payloads crosses sensitive-resource boundaries and may violate least-privilege principles when users ...[truncated 2240 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to collecting only aggregate health, token, latency, and cost metrics.
2. Make transcript, memory, tool-payload, log, and message-flow collection independently opt-in.
3. Clearly disclose the exact data fields collected before enabling each sensitive source.
4. Apply secret detection and redaction before data is written to disk, displayed by the dashboard, or synchronized externally.
5. Avoid collecting complete tool parameters and results by default; use allowlisted metadata fields instead.
6. Require strong authentication and authorization for every dashboard and API endpoint, including localhost endpoints.
7. Bind the service to loopback by default and reject cross-origin or non-local access unless explicitly configured.
8. Encrypt sensitive telemetry at rest and protect encryption keys using operating-system credential storage.
9. Implement configurable retention limits, secure deletion, data export, and per-source purge controls.
10. Require explicit, informed confirmation before cloud synchronization and visibly indicate when synchronization is active.
11. Document cloud endpoints, key-management behavior, authentication controls, and failure handling.
12. Provide the executable implementation for review so that encryption, storage, endpoint authorization, and network behavior can be independently verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

- **Usage** — per-model and per-session cost tracking over time
- **Alerts** — budget alerts, anomaly detection, spending thresholds
- **Approvals** — tool approval workflows and audit logs
- **Self-Evolve** — agent self-improvement metrics and scoring
- **Notifications** — channel activity monitoring (Telegram, Slack, etc.)

## ClawMetry Cloud

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises extensive telemetry collection, local dashboard access on localhost, transcript viewing, memory file viewing, tool parameters/results, and optional cloud sync, but it does not prominently warn users that highly sensitive operational and conversational data may be exposed locally or transmitted off-machine when sync is enabled. In an agent environment, this telemetry can include secrets, prompts, file contents, and user messages, so insufficient disclosure creates a real confidentiality risk even if the feature is intentional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.