ClawHub
Back to skill

Security audit

TokFlow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local TokFlow query wrapper, but it can reveal local usage, cost, prompt-metric, and balance information to the agent.

Install only if you trust the local TokFlow backend on localhost:8001 and are comfortable exposing OpenClaw usage, cost, prompt-metric, and provider balance data to your agent. Prefer pinned ClawHub CLI versions and avoid command-line token login; use browser or safer secret handling when available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Unpinned npm CLI Execution Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md:8, README.md:24, and README.md:32
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Relevant code snippets:

bash
npx clawhub add tokflow
bash
npx clawhub login
bash
npx clawhub publish integrations/openclaw-skill --slug tokflow --name "TokFlow" --version 0.5.0 --changelog "v0.5.0 提问方式监控与优化：提问轮次统计、四规则建议、节省预估、prompt-stats 命令"

Technical Analysis

The documented npx clawhub commands do not specify a reviewed package version or integrity constraint. If the package is not already installed locally, npx can retrieve and execute the package selected by the npm registry at invocation time.

Consequently, the effective executable can change after this Skill has been reviewed. Compromise of the upstream package, maintainer account, package publication process, or registry resolution could cause users to execute attacker-controlled code. This is particularly sensitive for the login and publish workflows because they may run in an environment containing publishing credentials.

No evidence shows that the current clawhub package is malicious. The vulnerability is the mutable, unpinned execution method recommended by the documentation.

Attack Path

  1. An attacker compromises the clawhub npm package, its maintainer account, or its publication pipeline.
  2. The attacker publishes a malicious version under the expected package name.
  3. A user follows the README and invokes an unversioned npx clawhub command.
  4. npx resolves and downloads the attacker-controlled version.
  5. The package executes with the invoking user's privileges.
  6. Malicious package code accesses files, environment variables, authentication material, or publishing credentials available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the us ...[truncated 317 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a reviewed version, for example npx clawhub@<reviewed-version> ....
  • Record and verify package integrity through a lockfile or an equivalent trusted integrity mechanism.
  • Prefer installing the reviewed CLI once and invoking the trusted local installation rather than allowing every command to perform mutable package resolution.
  • Use restricted CI or publishing environments that expose only the minimum credentials required.
  • Review package provenance and signatures before version upgrades.
  • Avoid running installation or publishing commands with administrator privileges.

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:27
Finding

Authentication Token May Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: README.md:27
Vulnerability Type: Sensitive token exposure through process arguments and shell history
Risk Level: Medium

Complete code snippet:

bash
npx clawhub login --token <token> --no-browser

Technical Analysis

The documented non-browser authentication method places the authentication token directly in a command-line argument. Depending on the operating system and shell configuration, command arguments may be exposed through shell history, process inspection interfaces, terminal transcripts, audit facilities, CI logs, debugging output, or command wrappers.

During command execution, another local process or user with sufficient process-inspection access may be able to read the argument. After execution, the token may remain in persistent shell history or automation logs. This unnecessarily broadens access to a credential that should only be available to the authentication client.

The repository does not contain a hardcoded token, and exploitation requires a user to replace the placeholder with a real credential and execute the documented command.

Attack Path

  1. A user replaces <token> with a valid ClawHub token and executes the documented command.
  2. The complete command is recorded in shell history, terminal logs, CI output, or system audit records, or is exposed through process argument inspection while running.
  3. Another local user, process, administrator, or log reader obtains the token.
  4. The attacker reuses the token against ClawHub.
  5. The attacker performs whichever account or publishing operations the token authorizes.

Impact Assessment

The impact is limited by the compromised token's permissions. A token with publishing privileges could permit unauthorized package publication, replacement of trusted releases, account actions, or downstream supply-chain attacks. A lower-privileged token would expose only the ope ...[truncated 97 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace command-line token input with a hidden interactive prompt that reads the token from standard input without echoing it.
  • Support a protected credential store or a permission-restricted token file.
  • If environment-variable authentication is supported, ensure logs do not print the environment and clearly document its residual exposure risks.
  • Remove the token-bearing command from shell history if no safer interface is available, and warn users not to place it in shared scripts or CI command output.
  • Use short-lived, narrowly scoped tokens and rotate any token that may have appeared in history or logs.
  • Ensure CI systems inject secrets through their dedicated secret-management mechanism with output masking enabled.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation is written entirely in Chinese and the usage examples direct users to ask in Chinese phrases, without offering a language choice or stating that the skill is intentionally limited to a Chinese-speaking environment. This creates a natural-language locale constraint without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation examples are broad natural-language phrases such as 'token 消耗', '本月费用', and '优化建议', which can overlap with ordinary conversation and may cause the skill to trigger when the user did not explicitly intend tool use. In an agent setting, over-broad activation can expose internal usage data, costs, or balances unnecessarily and increases the chance of unintended backend queries to the local service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill performs network-capable actions via a localhost API but does not declare any tool scope, permissions, or allowed-tools boundaries. That creates an authorization and transparency gap: an agent may invoke networked behavior the user or platform did not explicitly approve, and localhost services are often highly privileged because they can expose sensitive operational data unavailable from the public network.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation text uses broad triggers such as token usage, model costs, optimization advice, balances, and prompt optimization, which can cause the skill to activate for loosely related user requests. Because the skill analyzes local usage data and can query balances and prompt/session-derived metrics, overbroad routing increases the chance of unintended access to sensitive local telemetry without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that data comes from local JSONL conversation files and supports prompt-style analysis, but it does not clearly warn users that their local conversation content and metadata may be analyzed. This is a meaningful privacy issue because prompt/session files can contain sensitive business data, secrets, personal information, or internal usage patterns, and users may not expect such inspection from a cost-optimization skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language instructions, command descriptions, and messages exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The docstring presents the available commands as the authoritative usage documentation, but it does not mention prompt-stats. Later, the program advertises and handles prompt-stats as a valid command, so the inline documentation actively misstates what the code can do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says the skill is for token usage, model cost, balances, and prompt-method analysis/optimization, so the underlying capability itself is in scope. However, this file's own module docstring command list at L011-L019 omits the implemented prompt-stats command, while the actual CLI dispatcher exposes it at L269-L270 and the help output lists it at L234 and L274. This creates a semantic mismatch between documented behavior and actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.