Ai Cost Optimizer

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

The skill mainly performs local AI pricing calculations, but it also recommends running an unpinned external installer script that is outside the reviewed artifact.

Install only if you are comfortable with a Chinese-localized, static pricing helper. Avoid the recommended openclaw-cn-installer path unless you separately review and trust that skill; prefer manually editing configuration or using pinned, verified installer versions. Treat the price data as advisory and verify current provider pricing before making cost decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: recommend.js:183

Finding

Execution of an Unreviewed External Installer from a Mutable Supply-Chain Source

Content

View full analysis

Vulnerability Details

File Location: recommend.js:183-184; SKILL.md:217-218
Vulnerability Type: Insecure third-party dependency and external installer workflow
Risk Level: Medium

The project recommends downloading an external Skill through the mutable latest release of clawhub and subsequently executing a setup script supplied by that external Skill.

Complete vulnerable code in recommend.js:183-184:

js

console.log('     npx clawhub@latest install openclaw-cn-installer');
console.log(`     node ~/.openclaw/skills/openclaw-cn-installer/setup-ai.js ${MODELS[scenario.recommend].provider}`);

Corresponding instructions in SKILL.md:217-218:

bash

npx clawhub@latest install openclaw-cn-installer
node ~/.openclaw/skills/openclaw-cn-installer/setup-ai.js deepseek

Technical Analysis

The command uses the mutable clawhub@latest package version and installs the separately maintained openclaw-cn-installer Skill. It then directs the user to execute that Skill's setup-ai.js file.

Neither the external Skill nor its setup script is included in the audited project. Consequently, this artifact provides no way to verify the downloaded code's integrity, permissions, behavior, or correspondence to a previously reviewed release. The effective code executed by a user can change independently after this project has been audited.

The project does not automatically run these commands; exploitation requires a user to follow the displayed or documented instructions. Nevertheless, presenting the workflow as the recommended configuration method establishes an avoidable supply-chain trust boundary.

Attack Path

1. An attacker compromises the package registry, the clawhub publisher account, the external Skill publisher, or a release artifact in the distribution chain.
2. The attacker publishes a modified release under the mutable version or Skill name referenced by ...[truncated 1187 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the documented manual configuration workflow so users do not need to execute an unrelated installer.
2. Replace clawhub@latest with a reviewed, exact version.
3. Pin the external Skill to an immutable release identifier rather than resolving the most recent release.
4. Publish and verify cryptographic integrity hashes or signed provenance for every downloaded artifact.
5. Vendor the required setup implementation into this repository if it is essential, allowing it to be audited with the rest of the project.
6. Review the external installer's source code, transitive dependencies, lifecycle scripts, filesystem access, and network behavior before recommending it.
7. Clearly disclose that the installer is third-party code and require explicit user confirmation before installation and execution.
8. Run any retained installer with the minimum required permissions and prevent it from accessing unrelated credentials or files where sandboxing is available.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

描述强调这是“成本优化器”，核心卖点包括自动计算费用、推荐最优模型、以及跨多个厂商模型进行成本对比。实际代码只包含一个 calculate.js 脚本，功能是：接收模型名和总 token 数，按静态单价表估算成本，默认将输入/输出 token 对半分，并在非 GPT-4o 情况下附加一个相对 GPT-4o 的节省对比。代码没有实现自动选择最优模型、没有遍历多个模型生成排名或推荐，也没有做声明中所暗示的完整多厂商比较分析。因此其主要用途仅是“单模型费用计算 + 与 GPT-4o 的简单比较”，与“成本优化器/推荐最优模型/全面对比工具”的描述存在实质性落差。未发现额外危险权限或隐藏资源访问，但功能描述明显大于实际实现。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill name, description, and author branding indicate a China-specific/Chinese-only positioning (e.g. 'ai-cost-optimizer-cn', 'OpenClaw CN') rather than presenting language or locale as a user choice. The file does not state that Chinese is optional or that other locales are supported, which can violate the policy against forcing a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs users to execute npx clawhub@latest, which fetches and runs the latest published package without pinning to a specific version. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

This instruction again uses npx clawhub@latest, causing unpinned execution of remote package code. Repeating the pattern in setup guidance increases exposure because users may run it in trusted local environments, enabling supply-chain compromise if the package or dependency chain is hijacked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This JavaScript file is a code file, so SQP-3 applies to its natural-language strings. The header comment and nearly all user-facing console output are in Chinese, with no option to select another language and no documented justification that this is a region-specific skill, which fits the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The model entry labels GLM-5-Turbo as '限时免费', but the same object assigns nonzero input and output prices (12 and 18), which means the code will calculate a positive cost for it. This is an active contradiction between documentation-like metadata presented to users and the actual behavior of the cost comparison logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description is written entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language or locale policy if the skill is expected to be broadly usable without requiring a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This JavaScript file contains user-facing descriptions and prompts exclusively in Chinese, including the header description, menu options, questions, and setup instructions. That creates a natural-language locale constraint without any user choice, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script prints an instruction to run npx clawhub@latest install openclaw-cn-installer, which fetches and executes remote package code without pinning to a specific trusted version. If the upstream package is compromised or a malicious release is published, users following the recommendation could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description says only 'AI-powered skill for productivity,' which does not match the stated purpose of AI cost optimization. This kind of mismatch can cause the skill to be invoked in overly broad contexts, obscuring its actual behavior and reducing a user's ability to make informed trust decisions about what the skill does.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description is so broad that it fails to constrain when the skill should be selected, increasing the chance it is triggered outside its intended cost-analysis use case. In agent ecosystems, ambiguous manifests can lead to over-invocation, accidental data exposure to an unnecessary skill, or user confusion about why this skill was chosen.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language messages, help text, and examples are presented in Chinese throughout, including error messages and usage guidance. This imposes a specific language on users without any opt-in or indication that the tool is intentionally limited to a Chinese-language audience.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This manifest file includes only a general capability description about optimizing AI model costs and recommending the best model, but it does not define specific trigger phrases, activation scope, or exclusion conditions. In systems that use manifest text for routing or invocation, such broad wording can increase the chance of unintended matching to generic cost-comparison requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.