Session Token Ledger

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This is a coherent local token-audit skill, but it needs review because it can persistently scan sensitive session transcripts and has a real path-handling bug that may write outside its intended folder.

Install only if you are comfortable with a local tool reading completed OpenClaw session transcripts and storing derived usage ledgers. Prefer manual rebuilds until the timestamp filename validation and output-path containment bug is fixed; enable the hook only if you explicitly want ongoing automatic scans, and remove the hook when you no longer need it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rebuild_sqlite.py:257

Finding

Path Traversal Through an Unvalidated Transcript Timestamp

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs use of local files and executable commands (python3, sqlite3) and references assets that are rebuilt and written locally, but it does not declare any explicit tool scope such as allowed tools or permissions. That mismatch creates an authorization ambiguity: an agent may read environment data or modify local files more broadly than intended when fulfilling the workflow, especially because the skill explicitly mentions rebuild/update operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The instructions direct the user to install persistent workspace hooks under ~/.openclaw, causing the behavior to survive beyond a single session and run on future events automatically. Persistent installation is not inherently malicious, but in this context it increases the risk of unnoticed long-term transcript processing and accumulation of sensitive derived data.

Content

Scanner excerpt · references/hook-setup.md (reported line 13)May include surrounding context.

md

- `/stop`
- gateway startup

## Files to create in your workspace

Create a hook folder:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented hook changes the skill from a user-invoked local analysis tool into an automatically triggered monitor that scans session transcript files and maintains derived ledgers on multiple lifecycle events. That broadens data collection and persistence behavior beyond ad hoc inspection, increasing privacy risk and attack surface if sensitive transcript content is processed or retained without explicit, informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The hook description states that completed transcript content is logged from session files and that ledger files are written automatically, but it does not provide a clear privacy warning or data-handling disclosure. Because transcripts may contain secrets, prompts, or personal data, silent background processing and persistence can expose sensitive information to unintended local readers or future tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The hook executes a local Python subprocess automatically during routine events, which introduces code-execution capability not strictly required for a read-only audit skill. Even though the command is fixed and local, auto-executing a script expands the trust boundary and can become dangerous if the script, its dependencies, or the target skill directory are modified.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/rebuild_sqlite.py (reported line 268)May include surrounding context.

python

provider, agent, channel, started_at, ended_at, input_tokens, output_tokens, total_tokens,
                cache_read_tokens, cache_write_tokens, billing_mode, cost_applicable, estimated_cost_usd, pricing_note,
                usage_entries, bad_lines, total_lines, was_reset_file, reset_source, updated_at
              ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)''',
            (
                record['session_id'], record['date'], n, record.get('session_key'), record['file_path'], ledger_file,
                record.get('model'), record.get('provider'), record.get('agent'), record.get('channel'),

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script embeds all diagnostic narrative strings in Chinese and emits them unconditionally in generated reports. This imposes a specific language on users without offering a locale option, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code writes generated report content to a user-specified path or an automatically created path via Path(args.output).write_text(text). Although the CLI option names imply saving, there is no explicit warning, confirmation, or inline comment/docstring disclosing that a file will be created or overwritten at the chosen path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.