T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:48- Finding
Overbroad Access to Agent Configuration and Unapproved Automated Changes
- Content
View full analysis
- Remediation
View remediation
Security audit
Wave Token Saver
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent token-cost audit tool, but it gives agents broad access to local OpenClaw configuration and allows some persistent changes without explicit approval.
Install only if you are comfortable with the agent reading OpenClaw cron and gateway configuration and proposing changes to prompts, model routing, bootstrap context, and scheduled tasks. Before using it, require a read-only audit first, ask for exact paths and diffs, and approve each write or cron/config change explicitly, including changes labeled Safe.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases include broad natural-language requests such as "token 优化" and "检查 token 消耗", which can plausibly match ordinary user intent and cause the skill to activate unexpectedly. Because the skill then directs inspection of local configs and creation of reports, accidental invocation can expand the skill's authority and lead to unanticipated file reads or edits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates writing a report file after execution without first requiring user awareness or consent for file creation. In an agent environment, silent artifact creation is risky because it changes the workspace state, may leak operational details into persisted files, and can surprise users who expected analysis-only behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quick-start paths instruct the agent to "apply directly" and even skip validation/monitoring, while the broader skill includes config and prompt optimization actions. This combination increases the chance of immediate, unreviewed modifications to prompts or configuration files, which can break automation, alter agent behavior, or create hard-to-audit changes without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase is a broad natural-language request that can easily appear in ordinary conversation, causing the skill to activate when the user may only be asking generally about token usage. In an agent environment, overly generic activation increases the chance of unintended workflow execution, context capture, and policy bypass through accidental invocation rather than explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example request for a 'full token audit report' is broad and lacks activation guardrails, making it likely that ordinary audit-related user requests will trigger the complete multi-phase skill automatically. This is dangerous because expansive skills can consume excess context, perform unintended analysis steps, and override the principle of least surprise for users and calling systems.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The appendix says first execution populates deployment-specific configuration, implying inspection of local environment details and possible replacement of example values, but it does not clearly disclose those actions. Even if the likely behavior is administrative rather than malicious, undisclosed local config discovery and possible writeback are side effects users should knowingly approve.
- Content
Static analysis
No suspicious patterns detected.