OpenClaw Scheduler Token Auditor

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:21 PM UTC
• Version: 1.0.2

Overview

The skill is a scheduler token auditor, but it tells the agent to inspect session histories without clear limits, which can expose private conversations.

Review before installing. Use this skill only if you are comfortable with an agent listing sessions and reading relevant session transcripts while auditing token usage. Prefer cron usage totals first, ask for confirmation before transcript access, limit review to the specific job/session and recent turns needed, and avoid including raw transcript content in reports.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:110

Finding

Overbroad Access to Potentially Sensitive Session Transcripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 110-116
Vulnerability Type: Excessive access to session history and potentially unrelated sensitive data
Risk Level: Medium

Vulnerable Code

markdown

Useful checks:

- `sessions_list` to find heartbeat sessions
- `session_status` to inspect context accumulation
- `sessions_history` to inspect recent transcript size, repetition, and tool fan-out

Related instructions also appear at lines 39 and 82:

markdown

2. **Session status, session lists, and transcripts are supporting evidence.**

markdown

5. Only after that, inspect session metadata or transcripts to explain *why* a verified expensive run happened.

Technical Analysis

The Skill instructs the Agent to enumerate sessions and retrieve session histories as part of a scheduler token audit. Session transcripts can contain private conversations, credentials, personal information, confidential tool output, and data unrelated to the scheduled task under investigation.

Transcript inspection may be useful for explaining a verified high-token run, but the Skill does not enforce the least-privilege controls needed for such access. In particular, it does not:

• Require explicit user authorization before reading transcripts.
• Restrict access to a user-selected or scheduler-owned session.
• Limit the number of turns or time range retrieved.
• Require redaction of credentials and unrelated personal information.
• Prohibit reproducing raw transcript content in the audit report.
• Prefer aggregate metadata before accessing message content.

The issue is therefore an overbroad data-access workflow rather than evidence of an external exfiltration mechanism. The audited file contains no destination URL, upload instruction, remote payload retrieval, or instruction to send transcript data to a third party. Its mention of “web fetches” at line 102 describes a possible historical source of token usage and does not direct the Agen ...[truncated 1607 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before retrieving any session transcript.
2. Restrict transcript access to a specifically identified scheduler-owned session associated with the audited job.
3. Use usage.total_tokens and aggregate session metadata as the primary evidence; access message content only after an exact expensive run has been established and explanation is explicitly requested.
4. Retrieve only the minimum required time range or number of turns rather than the complete session history.
5. Add an ownership and relevance check before every sessions_history call.
6. Redact credentials, tokens, personal information, and unrelated content before analysis or reporting.
7. Prohibit raw transcript reproduction in final reports; report only sanitized structural findings.
8. When authorization or session ownership cannot be established, classify the result as Inconclusive rather than reading additional data.
9. Document that transcript data must not be sent to external services or retained beyond the active audit.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description explicitly matches Chinese phrases alongside English ones, but the file does not state that multilingual triggering is optional or user-selected. Under the language/locale policy, hard-coding language handling without opt-in can be a policy concern unless the locale scope is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.