Openclaw Ai Cost Calc

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:39 AM UTC
• Version: 1.0.0

Overview

The calculator code is simple, but the install instructions ask users to execute a mutable remote npm installer that was not pinned to a reviewed version.

Before installing, prefer a pinned and reviewed clawhub installer version or verify the package provenance yourself. The calculator script appears local and limited, but running the documented install command gives the fetched npm package the permissions of your user account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned npm Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-14
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

markdown

## Installation

```bash
npx clawhub@latest install openclaw-ai-cost-calc

text

### Technical Analysis

The documented installation command uses `npx` to download and execute `clawhub@latest`. The `latest` npm distribution tag is mutable and does not identify a fixed, previously reviewed package version. No lockfile, package integrity hash, or vendored copy of this dependency is present in the audited project.

Consequently, the code executed by this command may change after the Skill has been reviewed. Although no malicious behavior was found in the included `calc.js`, the externally obtained installer is outside the audited project and cannot be verified from the available files.

This creates a supply-chain risk: compromise of the npm package, its publisher account, its release process, or a future package version referenced by `latest` could cause the installation command to execute attacker-controlled JavaScript.

### Attack Path

1. An attacker compromises the `clawhub` package, its publisher credentials, or its release pipeline.
2. The attacker publishes a malicious release and assigns it to the mutable `latest` tag.
3. A user follows the installation instructions and runs `npx clawhub@latest install openclaw-ai-cost-calc`.
4. `npx` retrieves and executes the attacker-controlled package.
5. The malicious package operates with the permissions of the user who invoked the command and can access resources available to that account.

### Impact Assessment

Successful exploitation permits arbitrary code execution with the invoking user's privileges. Depending on that user's permissions and environment, the malicious dependency could read or modify user-accessible files, collect credentials or environment variables, alter installed skills, execute additional programs, or establish persiste
...[truncated 202 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version, for example:

   bash

   npx --yes clawhub@<reviewed-exact-version> install openclaw-ai-cost-calc
   

2. Verify the selected release against a trusted integrity hash or signed provenance before execution.
3. Use a committed lockfile where applicable and enforce integrity checks during installation.
4. Document the expected package registry and source repository so users can detect registry substitution or an unexpected publisher.
5. Review new dependency versions before updating the pinned version.
6. Run installation with an unprivileged account in a restricted environment and avoid sudo or administrator execution.
7. Where practical, install the reviewed package without lifecycle scripts first, inspect its contents, and only then execute the required command.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill when 'choosing AI models or estimating API costs,' which is a broad natural-language condition rather than a specific trigger phrase or narrowly defined activation context. Without clearer scope or exclusion examples, this could overlap with many general conversations about AI models and pricing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a reviewed, pinned release. That creates a supply-chain risk: if the package is compromised or a malicious version is published later, users of this skill could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The model pricing examples present both dollar and yuan-denominated values, including Chinese-unit notation like 'per万tokens,' but the document does not explain locale handling or offer a user choice of currency/format. This can create an implicit locale assumption in user-facing content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.