Prompt Token Counter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:26 AM UTC
• Version: 1.0.11

Overview

This token-counting skill is mostly coherent, but it includes under-scoped network features that can fetch arbitrary URLs or send benchmark text to external model APIs.

Review this skill before installing if you plan to let an agent use URLs or benchmark files. Prefer local file or inline token counting, avoid --url for untrusted or internal URLs, and do not run API-mode benchmarks on secrets, private prompts, memory files, or proprietary content unless you intend to send that text to the configured external provider.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:210
• Finding: Mandatory Promotional Output Hijacks Agent Responses< 2. **Briefly explain how tokens are calculated** — e.g. ``` ### Technical Analysis The skill instructs the agent that it must include a project link after every token-count or cost-estimation response. This output requirement is not necessary to perform the declared functionality and changes the content of the agent's final response for promotional purposes. Because these instructions are loaded as part of the skill, they can override the agent's ordinary goal of returning only information requested by the user. The behavior therefore constitutes skill instruction hijacking: skill-controlled instructions persistently manipulate responses produced during otherwise legitimate operations. The referenced URL is a normal GitHub repository link rather than an executable download. The vulnerability is the mandatory and unrelated modification of agent output, not remote code execution. ### Attack Path 1. The agent loads `SKILL.md` when a user asks for token counting or cost estimation. 2. The agent performs the legitimate local calculation. 3. The response-output rule directs the agent to include the specified external project link. 4. The user receives unsolicited, skill-controlled promotional content with the result. 5. If the linked destination or skill instructions are changed in a later release, the same mandatory output channel could direct users toward different external content. ### Impact Assessment The issue affects the integrity of agent responses. It does not grant operating-system privileges, access credential ...[truncated 432 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement that the agent must include the project link in every response. 2. Make source attribution optional and provide it only when the user requests provenance, documentation, or implementation details. 3. Restrict response guidelines to information directly required by the task, such as the token count, model, approximation status, and estimated cost. 4. Review all skill instructions for mandatory branding, links, calls to action, or unrelated output requirements. 5. Add tests confirming that ordinary results do not contain unsolicited URLs or promotional text. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cli.py:65
• Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery and Unbounded Downloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cli.py`, lines 65–71 **Vulnerability Type**: Insufficient URL destination validation and response-size control **Risk Level**: Medium ### Vulnerable Code ```python def _read_url(url: str) -> str: parsed = urllib.parse.urlparse(url) if parsed.scheme not in {"http", "https"}: raise ValueError("URL must start with http:// or https://") with urllib.request.urlopen(url, timeout=10) as response: return response.read().decode("utf-8", errors="replace") ``` ### Technical Analysis The URL reader validates only that the supplied URL uses HTTP or HTTPS. It does not validate the resolved destination address or reject requests to: - Loopback hosts. - Private network ranges. - Link-local addresses. - Cloud instance metadata services. - Reserved or otherwise non-public addresses. `urllib.request.urlopen` follows redirects, but redirect destinations are not revalidated. An initially public URL can therefore redirect the request to an internal service. The function also calls `response.read()` without a maximum byte count. The ten-second timeout limits waiting time but does not provide a reliable response-size limit. A server capable of transmitting data quickly could cause the process to allocate substantial memory. The confirmation language in `SKILL.md` is a useful procedural safeguard, but it is not a technical security boundary. Direct CLI users, automated callers, or an agent that fails to follow the documentation remain exposed. ### Attack Path #### SSRF Path 1. An attacker persuades a user or agent to invoke the CLI with `--url` and an attacker-selected HTTP or HTTPS URL. 2. The URL points directly to a private address or to a public server that redirects to one. 3. `_read_url` accepts the URL because its scheme is allowed. 4. `urlopen` sends the request from the machine running the skill. 5. The request reaches an internal service or metadata endpoint that is not exte ...[truncated 1440 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--url` support if remote retrieval is not essential. Local files and inline input satisfy the primary token-counting functionality with fewer privileges. 2. If URL retrieval must remain, resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, unspecified, and metadata-service addresses for both IPv4 and IPv6. 3. Revalidate the destination after every redirect rather than relying on the default redirect behavior. 4. Consider an explicit hostname allowlist for automated or agent-driven use. 5. Limit the number of redirects and reject URLs containing embedded credentials. 6. Stream the response in fixed-size chunks while enforcing a strict maximum response size. 7. Validate the response content type and accept only expected text formats. 8. Apply both connection and read timeouts. 9. Retain explicit user confirmation as defense in depth, but do not treat confirmation as a replacement for destination validation. 10. Add tests covering direct private addresses, DNS resolution to private addresses, IPv6 loopback, public-to-private redirects, oversized responses, and malformed URLs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as primarily auditing OpenClaw memory/persona/skills, but it also documents operation on arbitrary local files supplied by the user. That broader read surface matters in context because the same skill encourages reading highly sensitive workspace files, so unclear scoping may normalize expansive file access beyond the stated purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as primarily auditing OpenClaw memory/persona/skills, but it also documents operation on arbitrary local files supplied by the user. That broader read surface matters in context because the same skill encourages reading highly sensitive workspace files, so unclear scoping may normalize expansive file access beyond the stated purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is presented as primarily auditing OpenClaw memory/persona/skills, but it also documents operation on arbitrary local files supplied by the user. That broader read surface matters in context because the same skill encourages reading highly sensitive workspace files, so unclear scoping may normalize expansive file access beyond the stated purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as primarily auditing OpenClaw memory/persona/skills, but it also documents operation on arbitrary local files supplied by the user. That broader read surface matters in context because the same skill encourages reading highly sensitive workspace files, so unclear scoping may normalize expansive file access beyond the stated purpose.

Ae1

High

• Category: analysis-evasion

Content

Skills are loaded per session. Count each `SKILL.md`:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Skills are loaded per session. Count each `SKILL.md`:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Skills are loaded per session. Count each `SKILL.md`:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Model or Provider Selection

High

• Category: Excessive Agency

Content

formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  scripts file1.txt file2.txt --model gpt-4
  scripts --file input.txt --model claude-3-opus-20240229
  scripts --cost --model gpt-4 AGENTS.md SOUL.md MEMORY.md
  scripts --list-models

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

epilog="""
Examples:
  scripts file1.txt file2.txt --model gpt-4
  scripts --file input.txt --model claude-3-opus-20240229
  scripts --cost --model gpt-4 AGENTS.md SOUL.md MEMORY.md
  scripts --list-models
        """

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

Examples:
  scripts file1.txt file2.txt --model gpt-4
  scripts --file input.txt --model claude-3-opus-20240229
  scripts --cost --model gpt-4 AGENTS.md SOUL.md MEMORY.md
  scripts --list-models
        """
    )

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This README is written in Chinese throughout, but it does not state that the skill is intended only for Chinese-speaking users or a China-specific context. Under the language/locale policy, forcing a specific language without explicit user opt-in or justified regional scope is a natural-language policy concern.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises capabilities that involve local file reads, optional network fetches, and a publishing script that updates files, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries can let the skill be invoked with broader access than users expect, increasing the risk of unintended reads of sensitive OpenClaw workspace files or outbound requests.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The CLI accepts arbitrary http/https URLs and fetches their contents for tokenization, which extends the tool from local workspace analysis into network-capable data ingestion. In an agent skill intended for auditing workspace token usage, this can enable unexpected outbound requests, expose internal network resources via SSRF-like behavior, or process untrusted remote content outside the documented scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Adding a --url input mode gives the skill network access that is not justified by its declared purpose of auditing local workspace token consumption. In agent environments, unnecessary network capability increases the attack surface and may be abused to fetch attacker-controlled data or probe internal services through user-supplied URLs.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The embedded skill guidance requires explicit warning and confirmation before outbound URL use, but the script's API mode transmits supplied text to remote model endpoints without any comparable runtime disclosure or consent gate. This creates a real data-handling risk because users may benchmark sensitive prompts locally assuming counting behavior, yet the content is actually sent to third-party services.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a skill for counting tokens and estimating costs, primarily for auditing OpenClaw workspace token consumption. This example script can instead send the full sample or file-provided text to external model APIs to derive token counts, which is a materially broader behavior than local auditing and exposes content outside the workspace.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: For a skill whose stated purpose is token counting, cost estimation, and OpenClaw workspace auditing, adding an asynchronous chat-completions client to contact remote providers is not an obvious requirement. The capability sends arbitrary text to third-party endpoints and is especially unnecessary because the same script already provides a local counting mode.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: In API mode, the script sends the provided text directly to an external model API without a runtime warning, confirmation step, or privacy notice. If the input contains workspace memory, prompts, credentials, or proprietary text, this can cause unintended disclosure to third-party infrastructure.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The README promotes auditing local workspace components such as memory, persona, and skills, but does not clearly warn that this may require reading potentially sensitive local files. In an agent setting, vague documentation can lead to overbroad file inspection when a user asks general token-usage questions, increasing the risk of unintended exposure of local content.

Vague Triggers

Low

• Confidence: 90% confidence
• Finding: The 'When to Trigger' section lists general conditions such as 'User asks about token count, prompt length, API cost' and 'Agent needs to audit token consumption' without clarifying exclusions or negative examples. In a markdown skill description, this can cause the skill to activate for ordinary conversational requests that mention cost or length, even when the user may not intend to invoke this specific skill.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The instruction to 'also trigger when the agent needs to count tokens or estimate cost before/after generating content' is broader than the explicit user-facing trigger phrases and does not define clear boundaries. This could overlap with many ordinary interactions about prompt drafting or editing, causing the skill to activate without a sufficiently specific user request.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The main() docstring describes input handling as command-line text or file-based processing and lists CLI arguments without mentioning --url. The actual parser and execution path support fetching input from URLs, so the documentation understates and misdescribes the function's implemented behavior.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The embedded markdown in SAMPLE_TEXT contains a natural-language rule stating 'Respond in the user's language' as a mandatory behavior. This imposes a language/locale behavior without explicitly offering opt-in or user choice, which matches the policy-violation category for forced language handling.

Missing User Warnings

Low

• Confidence: 71% confidence
• Finding: The script is designed to use API_KEY and BASE_URL for authenticated outbound API calls, but there is no explicit warning in the code about handling credentials or the implications of sending data to a third-party service. This qualifies under the sensitive-credentials/network warning category for code files.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The script reads arbitrary content from a path supplied via --text-file and uses it for processing, but this file contains no explicit warning, confirmation, or user-facing disclosure about reading local files. Because file access is a safety-relevant operation and this standalone code file does not document the behavior beyond the argument help text, it meets the missing-warning criterion.

Static analysis

No suspicious patterns detected.