Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to add the advertised usage badge, but it does so by persistently patching the OpenClaw Control UI with possible sudo access and optional recurring reapply.
Review the JavaScript and shell scripts before installing. Prefer running apply.sh manually against a verified Control UI directory, avoid the cron/heartbeat auto-reapply unless you explicitly want that persistence, and do not run it with sudo unless you trust the package to modify your OpenClaw UI files.
The declared purpose is to show per-message token usage in the Control UI. However, the supplied code is a removal script whose explicit purpose is to remove that badge from the UI. It modifies index.html, may restore from a backup, and deletes the JavaScript asset file. This is materially different from the stated functionality and represents an undeclared capability affecting UI files on disk.
The file deletion target is built from a user-influenced base path and then executed with optional sudo, creating a path-manipulation risk. Although ASSET is fixed, a malicious OPENCLAW_CONTROL_UI_DIR can redirect the removal to another location and cause unauthorized deletion of files named assets/oc-usage-badge.js in unintended directories.
PY
fi
$SUDO rm -f "$UI_DIR/assets/$ASSET"
echo "asset: removed"
echo "done. hard-refresh the Control UI tab."
The skill explicitly instructs the agent to run shell commands, modify files under the OpenClaw installation, and potentially use environment overrides, yet it declares no tool scope or permissions. That omission weakens reviewability and least-privilege controls, making it easier for a user or agent to execute filesystem and shell actions without an explicit permission boundary.
The skill is designed to persist a client-side patch by copying assets into the application's dist/control-ui directory and reapplying it after updates via cron or heartbeat routines. That persistence mechanism is security-relevant because it establishes ongoing code execution in the browser UI and survives normal operational changes, increasing exposure if the patch is ever modified maliciously.
## Requirement
Write access to the Control UI directory (default
`/usr/local/lib/node_modules/openclaw/dist/control-ui`). The scripts auto-use
`sudo -n` when that dir is not writable. Override the path with
`OPENCLAW_CONTROL_UI_DIR=/path/to/dist/control-ui` (also useful when OpenClaw is
The skill directs use of sudo -n to modify files inside a global application directory under /usr/local/lib/node_modules/openclaw/dist/control-ui. Any skill that can cause privileged file writes creates a serious trust boundary issue: if the asset or scripts are altered, it could inject persistent code into the admin UI with elevated operational impact.
Write access to the Control UI directory (default
`/usr/local/lib/node_modules/openclaw/dist/control-ui`). The scripts auto-use
`sudo -n` when that dir is not writable. Override the path with
`OPENCLAW_CONTROL_UI_DIR=/path/to/dist/control-ui` (also useful when OpenClaw is
installed under a user prefix, where no sudo is needed at all).
This is the same privileged-write pattern in the install/update section, reinforcing that routine skill execution may lead to root-assisted modification of shipped UI files. Normalizing repeated privileged execution increases the chance of persistent UI compromise or accidental damage to the installation.
`/usr/local/lib/node_modules/openclaw/dist/control-ui`). The scripts auto-use
`sudo -n` when that dir is not writable. Override the path with
`OPENCLAW_CONTROL_UI_DIR=/path/to/dist/control-ui` (also useful when OpenClaw is
installed under a user prefix, where no sudo is needed at all).
## Install / Update
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
fi
$SUDO cp "$SRC" "$UI_DIR/assets/$ASSET"
$SUDO chmod 644 "$UI_DIR/assets/$ASSET"
echo "asset: $UI_DIR/assets/$ASSET"
$SUDO python3 - "$UI_DIR/index.html" "$HASH" <<'PY'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
fi
SUDO=""
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
fi
SUDO=""
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
echo "index: restored from backup"
else
$SUDO python3 - "$UI_DIR/index.html" <<'PY'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
echo "index: restored from backup"
else
$SUDO python3 - "$UI_DIR/index.html" <<'PY'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
echo "index: restored from backup"
else
$SUDO python3 - "$UI_DIR/index.html" <<'PY'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
echo "index: restored from backup"
else
$SUDO python3 - "$UI_DIR/index.html" <<'PY'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
echo "index: restored from backup"
else
$SUDO python3 - "$UI_DIR/index.html" <<'PY'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if [ ! -w "$UI_DIR" ]; then SUDO="sudo -n"; fi
if [ -f "$UI_DIR/index.html.oc-usage-bak" ]; then
$SUDO cp "$UI_DIR/index.html.oc-usage-bak" "$UI_DIR/index.html"
echo "index: restored from backup"
else
$SUDO python3 - "$UI_DIR/index.html" <<'PY'
This privileged rm command deletes a path derived from the environment-controlled OPENCLAW_CONTROL_UI_DIR without constraining it to an expected base directory. If an attacker can influence the environment or trick an operator into running the script with a malicious directory value, the script may remove unintended files as root within an attacker-chosen path.
PY
fi
$SUDO rm -f "$UI_DIR/assets/$ASSET"
echo "asset: removed"
echo "done. hard-refresh the Control UI tab."
No suspicious patterns detected.