API Logger

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:19 PM UTC
• Version: 1.2.0

Overview

This appears to be a real API logging tool, but it installs an always-on proxy that can retain and forward full AI conversations with weak safeguards.

Review carefully before installing. Use only in a controlled environment, change the upstream to HTTPS before routing traffic, avoid sending secrets or regulated data through it, and treat the log directory as sensitive. Prefer on-demand operation over the default LaunchAgent, and do not use Feishu export unless the external exporter and destination are trusted.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: install.sh:45

Finding

Persistent LaunchAgent Installed and Kept Alive Without Separate Opt-In

Content

View full analysis

"$PLIST_PATH" << EOF Label com.lobster.api-proxy ProgramArguments /usr/bin/python3 ${INSTALL_DIR}/proxy.py --port ${PROXY_PORT} --upstream ${UPSTREAM} --log-dir ${LOG_DIR} RunAtLoad KeepAlive StandardOutPath ${LOG_DIR}/proxy.stdout.log StandardErrorPath ${LOG_DIR}/proxy.stderr.log WorkingDirectory ${INSTALL_DIR} EOF # 6. Load LaunchAgent launchctl unload "$PLIST_PATH" 2>/dev/null || true launchctl load "$PLIST_PATH" ``` ### Technical Analysis The installer creates a macOS LaunchAgent with both `RunAtLoad` and `KeepAlive` enabled and immediately loads it. Consequently, the API interception proxy starts automatically in future login sessions and is restarted whenever it exits. Continuous operation can be useful for transparent API logging, and the behavior is disclosed in the documentation. However, an always-on, self-restarting service is not the minimum privilege or lifetime required for an on-demand log viewer or manually operated proxy. The installer provides no separate persistence confirmation, nonpersistent installation mode, ...[truncated 1180 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:12

Finding

API Credentials and Conversation Data Forwarded to a Plaintext HTTP Upstream

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: proxy.py:59

Finding

Complete Prompts and Model Responses Stored in Plaintext Without Explicit Access Controls or Retention Limits

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.sh:35

Finding

Unpinned Dependency Installed Into the Active Python Environment

Content

View full analysis

/dev/null; then echo "aiohttp not detected, installing..." pip3 install aiohttp --quiet echo "aiohttp installed" else echo "aiohttp is ready" fi ``` ### Technical Analysis If `aiohttp` is unavailable, the installer invokes `pip3 install aiohttp` without a pinned version, integrity hash, explicit package index, or isolated virtual environment. Package selection is therefore controlled by the active pip configuration and package index state at installation time. A compromised index, malicious mirror configuration, dependency compromise, or future incompatible release could cause unexpected code to be downloaded and executed. Python package installation can execute build-system code during installation. The script also assumes that `python3` and `pip3` refer to the same environment, which is not guaranteed. This can install into an unintended user or system environment and still leave the runtime dependency unresolved. ### Attack Path 1. The target environment does not already provide `aiohttp`. 2. The user runs `install.sh`. 3. The script invokes the first `pip3` found through `PATH`. 4. Pip consults its configured index and selects the latest acceptable package and transitive dependencies. 5. A compromised or malicious artifact executes installation-time code under the user's privileges. 6. The installed code is later imported by the persistent proxy, extending execution across sessions. ### Impact Assessment A malicious package or build dependency can execute code with the installing user's privileges. It may access the user's files and credentials, modify installed code, or exploit the LaunchAgent persistence established by the sa ...[truncated 156 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: log_viewer.py:180

Finding

Sensitive Conversation Export Delegated to an Unverified External Script

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose is local API logging and viewing, but the skill also exposes log export to Feishu through an external helper and network-affecting behavior not clearly disclosed in the top-level description. Because the logs contain full prompts and conversations, this mismatch can mislead users into sending sensitive data to an external service they did not expect to be involved.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is explicitly designed to record complete prompts, generations, and token usage, which creates a direct data exposure path for highly sensitive natural-language content. In an LLM tooling context, that content can include secrets, proprietary code, credentials, personal data, and hidden system prompts, so comprehensive capture materially raises confidentiality risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

**文件：** `log-viewer.html`（skill 目录内）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

**文件：** `log-viewer.html`（skill 目录内）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

**文件：** `log-viewer.html`（skill 目录内）

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The viewer documentation specifically promotes displaying complete system prompts and multi-turn conversations in the UI, increasing the likelihood of accidental disclosure through local shoulder-surfing, screenshots, screen sharing, or copied exports. Because system prompts and chat history often contain hidden instructions and confidential user content, this goes beyond harmless observability.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documented log schema includes storage of full request bodies with system and message content, which is a strong indicator of persistent storage of sensitive conversational data. Persistent full-fidelity storage substantially increases blast radius if the logs are accessed by other users, malware, backups, or external export features.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This proxy is explicitly designed to intercept and persist full LLM request and response bodies, which commonly contain sensitive prompts, system instructions, user data, secrets, and model outputs. Even though auth headers are partially masked, the body logging creates a substantial confidentiality risk because sensitive content is stored in cleartext and can be exposed through local compromise, backups, or later sharing of logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes logging complete prompts, system prompts, generations, and token usage, but does not prominently warn that this can capture secrets, credentials, personal data, proprietary prompts, or regulated data. In this skill context, the proxy transparently intercepts all LLM traffic, making the privacy risk materially higher because users may not realize the full sensitivity and breadth of what is stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Documenting one-click Feishu export of full logged conversations without a clear warning about external sharing materially increases the chance of sensitive data exfiltration. Because the logged content includes complete prompts and model outputs, exporting it to a collaboration platform can expose confidential business data, secrets, or personal information to broader audiences or third-party systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The README instructs users to install a LaunchAgent plist that starts the proxy as a background service, creating persistence across sessions. In this context, persistent transparent interception of all LLM API calls is security-relevant because it continuously collects sensitive prompts and responses beyond a single troubleshooting session.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

md

- 复制 `proxy.py` 和 `log_viewer.py` 到 `~/.openclaw/workspace/company/api-proxy/`
- 创建日志目录 `~/.openclaw/workspace/company/api-logs/`
- 检查并安装 `aiohttp` 依赖
- 写入 LaunchAgent plist（`~/Library/LaunchAgents/com.lobster.api-proxy.plist`）
- 加载 plist，启动后台代理服务

### 2. 手动配置（重要！）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Loading the LaunchAgent to start a background proxy establishes ongoing session persistence. While persistence is not inherently malicious, in a skill that transparently logs complete LLM traffic it increases exposure by continuously operating after installation and possibly after the user forgets it is enabled.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

md

- 创建日志目录 `~/.openclaw/workspace/company/api-logs/`
- 检查并安装 `aiohttp` 依赖
- 写入 LaunchAgent plist（`~/Library/LaunchAgents/com.lobster.api-proxy.plist`）
- 加载 plist，启动后台代理服务

### 2. 手动配置（重要！）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The documented use of launchctl to manage the plist confirms the proxy is intended to persist as a user agent. In this skill context, persistence magnifies the sensitivity of the logging capability because it enables long-lived monitoring of conversations and prompts.

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

修改后需要重新加载 LaunchAgent：

bash

launchctl unload ~/Library/LaunchAgents/com.lobster.api-proxy.plist
launchctl load ~/Library/LaunchAgents/com.lobster.api-proxy.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate persistence reference again indicates a user-level autostart mechanism via plist. In a logging proxy, autostart is more dangerous than a typical helper utility because it silently resumes interception after login unless the user actively disables it.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

bash

launchctl unload ~/Library/LaunchAgents/com.lobster.api-proxy.plist
launchctl load ~/Library/LaunchAgents/com.lobster.api-proxy.plist

3. 重启 Gateway（与用户确认后）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate persistence reference again indicates a user-level autostart mechanism via plist. In a logging proxy, autostart is more dangerous than a typical helper utility because it silently resumes interception after login unless the user actively disables it.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

bash

launchctl unload ~/Library/LaunchAgents/com.lobster.api-proxy.plist
launchctl load ~/Library/LaunchAgents/com.lobster.api-proxy.plist

3. 重启 Gateway（与用户确认后）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 221)May include surrounding context.

md

5. **日志大小**：流式请求会额外保存原始 SSE 数据（`response_body_raw_stream`），长对话的日志条目可能较大。

6. **端口冲突**：默认端口 18790，如需修改，同时更新 plist 和 `openclaw.json` 中的 `baseUrl`。

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Listing the LaunchAgents plist as an installed runtime artifact confirms an autostart persistence mechanism. In the context of a transparent API logging tool, this matters because it normalizes a background monitoring component that survives reboots/logins and may continue recording sensitive traffic without ongoing user awareness.

Content

Scanner excerpt · README.md (reported line 249)May include surrounding context.

└── proxy.stderr.log # 代理服务错误日志

~/Library/LaunchAgents/ └── com.lobster.api-proxy.plist # 开机自启动配置

text

---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and documents behaviors that involve filesystem writes, network access, shell execution, and persistent installation, but it does not declare any explicit tool scope or permission boundaries. That makes the capability set less transparent to users and reviewers, increasing the chance that sensitive operations are approved or invoked without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill emphasizes debugging and visualization benefits but does not present a prominent privacy warning that it records complete prompts, generations, and conversation contents. Since LLM traffic often includes credentials, internal instructions, or personal data, users may enable the logger without understanding the sensitivity of what will be stored.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A terminal viewer for local log inspection includes document publishing to Feishu, which expands the trust boundary from local analysis to third-party data transmission. In this context, the feature is especially risky because the underlying logs are described as containing complete prompts, responses, and user inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installation guidance configures a startup-persistent transparent proxy and redirects API traffic through it, but it does not prominently warn that this changes system behavior and causes ongoing interception and logging of requests. That makes the setup more dangerous in context because it can silently affect all future LLM traffic after initial installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill installs a macOS LaunchAgent plist for automatic startup, creating persistence for a component that intercepts and logs API traffic. Persistence is more dangerous here because it can continue collecting sensitive prompt and response data across sessions even after the user forgets it was enabled.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

1. 创建 `~/.openclaw/workspace/company/api-proxy/`
2. 复制 `proxy.py` 和 `log_viewer.py`
3. 创建日志目录 `~/.openclaw/workspace/company/api-logs/`
4. 写入 macOS LaunchAgent plist（开机自启动）
5. 启动代理服务

### 配置（安装后手动完成）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate finding also points to the LaunchAgent plist path, which is part of implementing login-session persistence. Persistent execution of a request-logging proxy increases the chance of prolonged collection of sensitive prompt/output data and makes accidental over-collection more likely.

Content

Scanner excerpt · install.sh (reported line 10)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INSTALL_DIR="$HOME/.openclaw/workspace/company/api-proxy"
LOG_DIR="$HOME/.openclaw/workspace/company/api-logs"
PLIST_PATH="$HOME/Library/LaunchAgents/com.lobster.api-proxy.plist"
PROXY_PORT=18790
UPSTREAM="http://model.mify.ai.srv/anthropic"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate finding also points to the LaunchAgent plist path, which is part of implementing login-session persistence. Persistent execution of a request-logging proxy increases the chance of prolonged collection of sensitive prompt/output data and makes accidental over-collection more likely.

Content

Scanner excerpt · install.sh (reported line 10)May include surrounding context.

sh

SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INSTALL_DIR="$HOME/.openclaw/workspace/company/api-proxy"
LOG_DIR="$HOME/.openclaw/workspace/company/api-logs"
PLIST_PATH="$HOME/Library/LaunchAgents/com.lobster.api-proxy.plist"
PROXY_PORT=18790
UPSTREAM="http://model.mify.ai.srv/anthropic"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer automatically executes pip3 install aiohttp, which downloads and runs code from the network during installation without prior approval, pinning, or integrity verification. Even though aiohttp may be a legitimate dependency for the proxy, silent dependency installation expands the trust boundary and exposes users to supply-chain risk.

Content

No source excerpt is available for this finding.