A trojanized skill hit 9x token amplification — the failed run cost more than either successful one

Notes on Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents (arXiv:2603.00902) — Ben Dong, Hui Feng, Qian Wang · March 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

Clawdrain is a trojanized OpenClaw skill that hides a multi-turn "Segmented Verification Protocol" (SVP) inside its SKILL.md instructions. Before it hands back a simple BBC-headline lookup, the skill demands a growing, comma-separated "calibration sequence" — and a companion script grades every submission PROGRESS, REPAIR, or TERMINAL. REPAIR forces a retry of the same step, so the exchange stretches into extra tool calls that get replayed back into context on every subsequent turn.

The test ran against a real OpenClaw v2026.2.9 instance on Gemini 2.5 Pro, with actual API billing instead of a simulator. The benign version of the query answers in about 28k context tokens; the trojanized versions ran to roughly 125k and 190k, a 6-7x amplification, and still returned the correct headline. Pushed further — sequence length 2000, five verification rounds — the agent never finished the protocol at all. It hit repeated REPAIR rejections, decided the skill was "faulty," and burned through a cascade of fallback attempts: retry, search the web, kill the stuck process, retry again. That failure alone cost about 249k tokens, roughly 9x amplification — more than either successful run. The agent also improvised: it wrote a Python one-liner to generate its calibration sequence instead of typing it token by token, cutting per-turn cost from about 1,000 tokens to roughly 30, a workaround the authors could never have seen in a simulator that only lets the agent call the malicious tool.

Key numbers

Amplification, successful SVP runs	6-7x baseline tokens
Amplification, failed high-parameter run	~9x baseline tokens
Failed-run context tokens consumed	~249k (vs ~28k baseline)
Emergent scripting workaround cost	~1,000 tokens → ~30 tokens/turn
Community-reported runaway automation	5.7M tokens overnight (non-malicious)

What this means for skill authors

The headline result here isn't the amplification ratio, it's that failure costs more than success. A skill tuned to sit just past the agent's compliance threshold doesn't need to complete its protocol to do damage — the agent's own recovery instincts do the expensive part for free: retry, search, fall back, retry again. That inverts the usual mental model where a broken attack is a cheap attack. Any cost-control design that assumes failed tool calls are low-risk because they didn't "succeed" is measuring the wrong thing.

The other finding worth sitting with: stealth here is a property of the interface, not the skill. The identical trojanized SKILL.md is glaringly obvious in a chat GUI that renders every tool call. Switch to a narrated TUI that only shows summary messages and it fades to mostly invisible; run it off a cron job or heartbeat trigger and nobody is watching at all. A vetted catalog that only inspects SKILL.md text at submission time is checking an artifact that behaves differently depending on who's watching it run — exactly the gap a pre-execution, static-only review can't close.

For skill authors, the tell is structural: does a skill demand a multi-step verification handshake before delivering an otherwise simple result? Does its documentation include narration instructions that tell the agent what to show the user rather than what to do? Both are cheap for a legitimate integration to skip and cheap for a malicious one to add. Runtime behavior checks — watching what a skill actually does under load, not just what its SKILL.md claims — are the layer this paper's numbers argue for.

Skills related to this research

translate-craft Translate Craft delivers translation that reads naturally in the target language, not like a translation. It covers 8 languages with language-specific rules for formality, tone, and cultural nuance, plus i18n framework setup (react-intl, i18next, ICU), RTL layout implementation, and locale-aware formatting for dates, currencies, and numbers.★ 110 seedance-antislop This skill strips hollow superlatives and bloated adjectives from Seedance 2.0 prompts, replacing them with concrete production language—camera moves, light sources, motion, and sound cues that a crew can actually execute. It classifies filler into six patterns (empty evaluators, borrowed tokens, tag salad, negation slop, adjective stacking, and feel-suffix words) and rewrites each class with observable details that preserve the user's intent without the padding.★ 5,445

Related notes

References

K. Zhou, Y. Zheng, Y. He, M. Xue, X. Gong, Y. Wang, K. Lam, "Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents," arXiv:2601.10955 (2026)
T. Schick et al., "Toolformer: Language Models Can Teach Themselves to Use Tools," NeurIPS 2023
Y. Liu et al., "Prompt Injection Attack against LLM-integrated Applications," arXiv:2306.05499 (2023)