{ "skill_name": "tokenguard", "skill_path": "/workspace/skills/clawhub-tokenguard", "skill_directory": "/workspace/skills/clawhub-tokenguard", "is_safe": false, "max_severity": "HIGH", "findings_count": 5, "findings": [ { "id": "llm_finding_tokenguard_0", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "HIGH", "title": "Hardcoded External Domain in Metadata (Potential Phishing/Data Collection)", "description": "The skill's homepage field points to 'clawhub.com', which appears to be a non-standard or potentially malicious domain. The legitimate Claude skills repository would typically use official Anthropic domains. This could be a typosquatting attempt or phishing vector to collect user data or distribute malicious skills. The domain is referenced as an installation source, which could lead users to download compromised versions of the skill.", "file_path": "SKILL.md", "line_number": null, "snippet": "homepage: 'https://clawhub.com/skills/tokenguard'", "remediation": "Verify the legitimacy of 'clawhub.com'. If this is not an official Anthropic domain, remove the homepage field or replace with a legitimate source. Users should only install skills from trusted, verified sources. Consider using official GitHub repositories or Anthropic-approved skill registries.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE security risks. While the core functionality (local cost tracking) is legitimate, there are several concerning patterns: (1) The homepage points to a suspicious non-standard domain 'clawhub.com' that could be a phishing vector, (2) Aggressive keyword baiting and fear-based marketing suggest social engineering tactics, (3) Unauthorized creation of hidden directories in user's home folder without clear disclosure, (4) Missing input validation could enable resource exhaustion attacks, (5) References to non-existent installation commands could confuse users. The skill does NOT appear to exfiltrate data to external servers or contain command injection vulnerabilities, which is positive. However, the combination of suspicious domain references, deceptive positioning, and unauthorized file system access warrants caution. The skill should not be used until the clawhub.com domain is verified as legitimate and the other issues are addressed.", "primary_threats": [ "Data Exposure Risk (suspicious external domain)", "Social Engineering (deceptive marketing, keyword baiting)", "Tool Exploitation (unauthorized file system access)", "Availability Disruption (missing input validation)", "Misleading Content (non-existent installation commands)" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "LLM analyzer identified suspicious domain with clear phishing risk. Domain 'clawhub.com' mimics legitimate naming patterns but is not verified as official. Combined with aggressive marketing tactics, this represents a credible social engineering vector.", "meta_exploitability": "Medium - Requires user to visit the domain or follow installation instructions", "meta_impact": "High - Could lead users to malicious skill versions or data collection sites" } }, { "id": "llm_finding_tokenguard_1", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "MEDIUM", "title": "Deceptive Skill Positioning - Over-Broad Trigger Keywords", "description": "The skill uses aggressive keyword baiting with terms like 'cost', 'budget', 'spending', 'limit', 'api', 'tokens', 'guard', 'monitor' to maximize activation frequency. Combined with urgent messaging ('Protect your wallet', 'One runaway loop = hundreds of dollars'), this creates artificial urgency to encourage installation and usage. The skill positions itself as 'Essential for any agent making paid API calls', which is an overstatement for what is essentially a local cost tracking utility.", "file_path": "SKILL.md", "line_number": null, "snippet": "keywords: ['cost', 'budget', 'spending', 'limit', 'api', 'tokens', 'guard', 'monitor'], description: 'Essential for any agent making paid API calls'", "remediation": "Reduce keyword baiting to only genuinely relevant terms. Tone down urgency messaging. Provide balanced description of capabilities without overstating necessity. Let users make informed decisions without fear-based marketing.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE security risks. While the core functionality (local cost tracking) is legitimate, there are several concerning patterns: (1) The homepage points to a suspicious non-standard domain 'clawhub.com' that could be a phishing vector, (2) Aggressive keyword baiting and fear-based marketing suggest social engineering tactics, (3) Unauthorized creation of hidden directories in user's home folder without clear disclosure, (4) Missing input validation could enable resource exhaustion attacks, (5) References to non-existent installation commands could confuse users. The skill does NOT appear to exfiltrate data to external servers or contain command injection vulnerabilities, which is positive. However, the combination of suspicious domain references, deceptive positioning, and unauthorized file system access warrants caution. The skill should not be used until the clawhub.com domain is verified as legitimate and the other issues are addressed.", "primary_threats": [ "Data Exposure Risk (suspicious external domain)", "Social Engineering (deceptive marketing, keyword baiting)", "Tool Exploitation (unauthorized file system access)", "Availability Disruption (missing input validation)", "Misleading Content (non-existent installation commands)" ], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "LLM analyzer identified clear social engineering patterns. The combination of over-broad keywords, urgent messaging, and exaggerated claims ('Essential for any agent') indicates deliberate manipulation tactics.", "meta_exploitability": "Low - Primarily affects skill discovery, not direct security", "meta_impact": "Medium - Misleads users about necessity, increases unwanted activations" } }, { "id": "llm_finding_tokenguard_2", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "MEDIUM", "title": "Unauthorized File System Access - Home Directory Storage", "description": "The skill creates and manages a hidden directory in the user's home directory (~/.tokenguard) without explicit user consent or clear disclosure in the description. It stores persistent data (limit.json, session.json, override.flag) that tracks user behavior across sessions. While the purpose is stated in documentation, the automatic creation of hidden directories and persistent tracking files represents unauthorized file system modification that users may not expect from a 'cost tracking' utility.", "file_path": "scripts/tokenguard.py", "line_number": null, "snippet": "TOKENGUARD_DIR = Path(os.environ.get('TOKENGUARD_DIR', Path.home() / '.tokenguard'))\nLIMIT_FILE = TOKENGUARD_DIR / 'limit.json'\nSESSION_FILE = TOKENGUARD_DIR / 'session.json'", "remediation": "Add explicit disclosure in the skill description that it creates ~/.tokenguard directory and stores persistent data. Request user confirmation before first use. Provide clear uninstall instructions including removal of ~/.tokenguard directory. Consider using a more visible location or agent-managed storage.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE security risks. While the core functionality (local cost tracking) is legitimate, there are several concerning patterns: (1) The homepage points to a suspicious non-standard domain 'clawhub.com' that could be a phishing vector, (2) Aggressive keyword baiting and fear-based marketing suggest social engineering tactics, (3) Unauthorized creation of hidden directories in user's home folder without clear disclosure, (4) Missing input validation could enable resource exhaustion attacks, (5) References to non-existent installation commands could confuse users. The skill does NOT appear to exfiltrate data to external servers or contain command injection vulnerabilities, which is positive. However, the combination of suspicious domain references, deceptive positioning, and unauthorized file system access warrants caution. The skill should not be used until the clawhub.com domain is verified as legitimate and the other issues are addressed.", "primary_threats": [ "Data Exposure Risk (suspicious external domain)", "Social Engineering (deceptive marketing, keyword baiting)", "Tool Exploitation (unauthorized file system access)", "Availability Disruption (missing input validation)", "Misleading Content (non-existent installation commands)" ], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "LLM analyzer correctly identified undisclosed file system access. However, the purpose is legitimate (local cost tracking) and data stays local. The issue is transparency, not malicious intent.", "meta_exploitability": "Low - Requires skill execution, data stays local", "meta_impact": "Low - Privacy concern but no data exfiltration" } }, { "id": "llm_finding_tokenguard_3", "rule_id": "LLM_RESOURCE_ABUSE", "category": "resource_abuse", "severity": "MEDIUM", "title": "Missing Input Validation - Potential for Resource Abuse", "description": "The script accepts arbitrary numeric inputs for cost amounts without validation of reasonable ranges. An attacker or buggy integration could pass extremely large values (e.g., 999999999999) causing integer overflow issues, excessive file writes, or storage exhaustion. The history command loads and displays all entries without pagination, which could cause memory exhaustion if the session file is manipulated to contain millions of entries.", "file_path": "scripts/tokenguard.py", "line_number": null, "snippet": "def set_limit(amount: float):\n \"\"\"Set spending limit.\"\"\"\n data = {\"limit\": amount, \"set_at\": datetime.now().isoformat()}\n save_json(LIMIT_FILE, data)\n\ndef log_cost(amount: float, description: str = \"\"):\n session = load_session()\n session[\"entries\"].append({...})", "remediation": "Add input validation: (1) Enforce reasonable ranges for cost amounts (e.g., 0.01 to 10000), (2) Limit maximum number of history entries (e.g., 10000), (3) Implement pagination for history display, (4) Add file size checks before loading JSON files, (5) Validate numeric inputs are not NaN or Infinity.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE security risks. While the core functionality (local cost tracking) is legitimate, there are several concerning patterns: (1) The homepage points to a suspicious non-standard domain 'clawhub.com' that could be a phishing vector, (2) Aggressive keyword baiting and fear-based marketing suggest social engineering tactics, (3) Unauthorized creation of hidden directories in user's home folder without clear disclosure, (4) Missing input validation could enable resource exhaustion attacks, (5) References to non-existent installation commands could confuse users. The skill does NOT appear to exfiltrate data to external servers or contain command injection vulnerabilities, which is positive. However, the combination of suspicious domain references, deceptive positioning, and unauthorized file system access warrants caution. The skill should not be used until the clawhub.com domain is verified as legitimate and the other issues are addressed.", "primary_threats": [ "Data Exposure Risk (suspicious external domain)", "Social Engineering (deceptive marketing, keyword baiting)", "Tool Exploitation (unauthorized file system access)", "Availability Disruption (missing input validation)", "Misleading Content (non-existent installation commands)" ], "aitech": "AITech-13.3", "aitech_name": "Availability Disruption", "aisubtech": "AISubtech-13.3.2", "aisubtech_name": "Compute Exhaustion", "scanner_category": "RESOURCE ABUSE", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "LLM analyzer identified valid concern about missing validation. However, exploitation requires deliberate misuse and impact is limited to local resource consumption.", "meta_exploitability": "Low - Requires intentional abuse or buggy integration", "meta_impact": "Low - Local resource exhaustion only, no data loss" } }, { "id": "llm_finding_tokenguard_5", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "LOW", "title": "Misleading Installation Instructions - Non-Existent Command", "description": "The installation instructions reference a 'clawhub install tokenguard' command that does not exist in standard Claude agent environments. This could confuse users or lead them to search for and potentially install malicious 'clawhub' tools. The manual installation instructions are valid, but the primary installation method references non-existent tooling.", "file_path": "SKILL.md", "line_number": null, "snippet": "```bash\nclawhub install tokenguard\n```\n\nOr manually:\n```bash\nmkdir -p ~/.openclaw/workspace/skills/tokenguard", "remediation": "Remove references to non-existent 'clawhub' command. Provide only the manual installation instructions that users can actually execute. If 'clawhub' is a real tool, provide a link to its documentation and installation instructions.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE security risks. While the core functionality (local cost tracking) is legitimate, there are several concerning patterns: (1) The homepage points to a suspicious non-standard domain 'clawhub.com' that could be a phishing vector, (2) Aggressive keyword baiting and fear-based marketing suggest social engineering tactics, (3) Unauthorized creation of hidden directories in user's home folder without clear disclosure, (4) Missing input validation could enable resource exhaustion attacks, (5) References to non-existent installation commands could confuse users. The skill does NOT appear to exfiltrate data to external servers or contain command injection vulnerabilities, which is positive. However, the combination of suspicious domain references, deceptive positioning, and unauthorized file system access warrants caution. The skill should not be used until the clawhub.com domain is verified as legitimate and the other issues are addressed.", "primary_threats": [ "Data Exposure Risk (suspicious external domain)", "Social Engineering (deceptive marketing, keyword baiting)", "Tool Exploitation (unauthorized file system access)", "Availability Disruption (missing input validation)", "Misleading Content (non-existent installation commands)" ], "aitech": "AITech-15.1", "aitech_name": "Harmful / Misleading / Inaccurate Content", "aisubtech": "AISubtech-15.1.1", "aisubtech_name": "Deceptive or Misleading Content", "scanner_category": "DECEPTIVE CONTENT", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "LLM analyzer correctly identified misleading installation instructions. The 'clawhub' command does not exist in documented Claude agent tooling.", "meta_exploitability": "Low - Informational issue, may cause confusion", "meta_impact": "Low - User confusion, potential for searching malicious tools" } } ], "scan_duration_seconds": 41.50794506072998, "duration_ms": 41507, "analyzers_used": [ "static_analyzer", "llm_analyzer", "meta_analyzer" ], "timestamp": "2026-02-07T21:12:46.271778" }