ClawHub
Back to skill

Security audit

Session Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward session-status display helper with local configuration writes and no evidence of exfiltration, deception, destructive actions, or privilege escalation.

Before installing, understand that this skill is intended to add token/model/context status text to responses and save display preferences in the OpenClaw workspace. The advertised hook and slash-command integration is not visible in the inspected artifact, so users should not assume automatic integration works unless the platform wires it separately.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill advertises automatic session monitoring, token/model reporting, toggle commands, formatting controls, and hook integration, but the provided file contains only documentation and no implementation. This mismatch is dangerous because users or operators may trust claimed monitoring and status features that do not actually exist, leading to blind spots, incorrect assumptions about session state, or unsafe operational decisions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill declares a runtime dependency on python3 and is flagged as having environment and file access capabilities, but it does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, undeclared capabilities make review and enforcement harder and can allow a seemingly simple monitoring skill to access local files or environment data unexpectedly.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The description field is entirely in Chinese and does not indicate that other languages are supported or that the user can choose their preferred language. This creates a natural-language policy concern because the skill presents a language constraint without explicit opt-in or justification.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The module docstring presents the skill description only in Chinese ('自动显示 token 消耗和模型信息'), indicating a fixed language choice in user-facing text. There is no opt-in, locale selection, or documentation showing that this is a region-specific tool, so it conflicts with the language/locale policy for natural-language content.

Static analysis

No suspicious patterns detected.