Security audit

Token Saver

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate token-cost optimization skill, but it can directly change persistent OpenClaw configs, prompts, model routing, tool settings, and memory/history files without clear per-change user approval.

Review this skill before installing if your agent has write access to OpenClaw configuration, scheduled jobs, startup files, memory files, or model/provider settings. Use it in read-only audit mode first, require exact diffs and backups before every persistent change, and avoid the Quick Wins or Express paths unless you explicitly approve the affected files and rollback plan.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: ` reference. | Safe | | **C3** Archive aged-out content | Move old diary entries, superseded milestones, and historical promoted entries to a dedicated archive directory. | Safe | ``` ### Technical Analysis The Skill uses its own “Safe” classification to permit changes without explicit user approval. However, several actions classified as safe are state-changing operations rather than read-only optimizations. They can include: - Changing the model assigned to an automated task. - Rewriting task prompts a ...[truncated 3085 chars]:50
Finding: Operational and Memory Files May Be Modified Without Explicit User Approval
Content: View full analysis
⚠️ **User confirmation gate**: Techniques marked **Moderate** or **High** risk > involve config changes, profile switches, or task merging. Before applying them, > present the proposed change using this template and get explicit approval: > > ``` > ## Proposed Change > **Technique**: [category/technique name] > **Target**: [file/config path] > **Before**: [current state, chars/tokens if measurable] > **After**: [proposed state, estimated savings] > **Risk**: [Moderate/High] > **Rollback**: [how to undo] > ``` > > Techniques marked **Safe** can be applied directly. ``` `SKILL.md:267-285`: ```markdown | **A3** Constrain output | Add "Answer concisely in ≤3 lines" or equivalent to reduce generated tokens. | Safe | | **A4** Remove redundancy | Delete "What NOT to do" sections — proper instructions make negatives implicit. | Safe | | **A5** Reference > inline | Replace full instructions for sub-tasks with file references ("See X.md") ...[truncated 3975 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad natural-language phrases such as 'token 优化' and especially '省点 token', which can plausibly occur in ordinary conversation and cause the skill to activate unexpectedly. Because this skill instructs the agent to inspect local configs, scheduled jobs, workspace files, and potentially modify them, accidental activation could lead to unintended file access or configuration changes without clear user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill defines trigger phrases in Chinese and English, while large portions of the instructions and examples are also partly Chinese, but it does not tell the user they may choose their preferred language or locale. This can amount to an implicit language policy because users are expected to interact using the provided language forms without an explicit opt-in or alternative-selection mechanism.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are very broad and map to common requests about saving or checking token usage, which can cause the skill to activate in situations where the user did not intend to invoke this framework. That creates prompt-routing ambiguity and can override more appropriate handling, leading to unintended behavior, incorrect workflow selection, or leakage of internal skill behavior into normal conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The test cases and expected outputs hard-code Chinese-language responses, which can pressure the system to answer in Chinese regardless of the user's broader language preference or environment defaults. While not a direct code-execution risk, this can degrade reliability, violate user-expectation boundaries, and cause incorrect localization behavior when the same skill is used in multilingual contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.