RedLine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:24 PM UTC
• Version: 0.2.0

Overview

The skill is aimed at usage pacing, but it documents automatic credential-reading scripts that are not actually included for review.

Review this carefully before installing. The stated goal is reasonable, but do not supply OAuth tokens to replacement scripts or copy missing scripts from unofficial sources. Only use a version that includes the usage scripts in the reviewed package or provides verifiable, signed source for them, with clear endpoint restrictions and token redaction behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

Credential-Handling Functionality Is Delegated to Missing and Unauditable Scripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-45
Additional References: README.md:13-14, README.md:27-36, README.md:64-66
Vulnerability Type: Sensitive credential handling through missing executable components
Risk Level: Medium

Evidence

markdown

### `claude-usage`

Reads the Claude Code OAuth token from macOS Keychain and calls the Anthropic usage API.

```bash
# Human-readable output with color bars
scripts/claude-usage

# JSON output (for programmatic use)
scripts/claude-usage --json

Requirements:

• macOS with security CLI (Keychain access)
• Claude Code OAuth token in Keychain (run claude login to set up)
• Token needs user:profile scope (standard Claude Code login provides this)

Token location: macOS Keychain, service Claude Code-credentials, account = your macOS username.

openai-usage

Reads the OpenAI OAuth token from OpenClaw's auth-profiles and calls the ChatGPT usage API.

bash

# Human-readable output with color bars
scripts/openai-usage

# JSON output
scripts/openai-usage --json

Requirements:

• OpenClaw with an authenticated openai-codex profile (run openclaw auth openai-codex)
• Auth profiles at ~/.openclaw/agents/main/agent/auth-profiles.json

text

### Technical Analysis

The skill explicitly claims that `scripts/claude-usage` reads a Claude OAuth token from macOS Keychain and that `scripts/openai-usage` reads an OpenAI OAuth token from an OpenClaw authentication-profile file. However, the audited package contains only `README.md` and `SKILL.md`; neither referenced executable is present.

Consequently, the security-critical implementation cannot be examined for:

- Restriction of outbound requests to official Anthropic and OpenAI endpoints.
- Safe construction of HTTP requests and command arguments.
- Prevention of OAuth-token disclosure through standard output, error output, logs, or except
...[truncated 2774 chars]

Remediation

View remediation

Remediation Suggestions

1. Include scripts/claude-usage and scripts/openai-usage in the same reviewed and versioned package, or remove all commands and claims referring to them.
2. Pin the scripts to a verifiable release and publish cryptographic checksums or signed release artifacts.
3. Restrict network requests to hard-coded, documented HTTPS origins operated by Anthropic and OpenAI. Reject redirects to other origins and retain TLS certificate verification.
4. Request and use only the minimum OAuth scopes required to retrieve usage information.
5. Never print, persist, cache, or include access tokens in command arguments, URLs, diagnostics, exception traces, or telemetry.
6. Read authentication files without modifying them, validate ownership and restrictive permissions, and avoid copying their contents into temporary files.
7. If temporary storage is unavoidable, use securely created user-only files and guarantee cleanup on normal and exceptional exits.
8. Add automated tests covering token redaction, endpoint allowlisting, redirect rejection, malformed authentication data, timeout behavior, and failure paths.
9. Update the installation documentation so users are not encouraged to obtain missing scripts from unofficial sources.
10. Ensure release validation fails when documentation references executable files that are absent from the packaged artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

text

**Requirements:**
- macOS with `security` CLI (Keychain access)
- Claude Code OAuth token in Keychain (run `claude login` to set up)
- Token needs `user:profile` scope (standard Claude Code login provides this)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

**Requirements:**
- macOS with `security` CLI (Keychain access)
- Claude Code OAuth token in Keychain (run `claude login` to set up)
- Token needs `user:profile` scope (standard Claude Code login provides this)

**Token location:** macOS Keychain, service `Claude Code-credentials`, account = your macOS username.

Static analysis

No suspicious patterns detected.