Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we design, implement, and evaluate Clawdrain, a Trojanized skill that induces a multi-turn "Segmented Verification Protocol" via injected SKILL.md instructions and a companion script that returns PROGRESS/REPAIR/TERMINAL signals. We deploy Clawdrain in a production-like OpenClaw instance with real API billing and a production model (Gemini 2.5 Pro), and we measure 6-7x token amplification over a benign baseline, with a costly, failure configuration reaching approximately 9x. We observe a deployment-only phenomenon: the agent autonomously composes general-purpose tools (e.g., shell/Python) to route around brittle protocol steps, reducing amplification and altering attack dynamics. Finally, we identify production vectors enabled by OpenClaw's architecture, including SKILL.md prompt bloat, persistent tool-output pollution, cron/heartbeat frequency amplification, and behavioral instruction injection. Overall, we demonstrate that token-drain attacks remain feasible in real deployments, but their magnitude and observability are shaped by tool composition, recovery behavior, and interface design.

翻译：以OpenClaw为代表的现代生成式智能体——一种具备社区技能生态系统的开源自托管个人助手——正日益受到关注并被广泛使用。然而，这些生态系统的开放性和快速增长往往超出了系统化安全评估的范畴。本文设计、实现并评估了Clawdrain，这是一种特洛伊木马式技能，通过注入的SKILL.md指令及返回PROGRESS/REPAIR/TERMINAL信号的伴生脚本，诱导智能体执行多轮次“分段验证协议”。我们在一个模拟生产环境的OpenClaw实例中部署了Clawdrain，该实例采用真实API计费和生产级模型（Gemini 2.5 Pro），实测令牌消耗量达到良性基线的6-7倍，在特定高成本故障配置下可达约9倍。我们观察到一个仅在生产部署中出现的现象：智能体自主组合通用工具（如shell/Python）以绕过脆弱的协议步骤，从而降低消耗放大效应并改变攻击动态。最后，我们识别出由OpenClaw架构启用的生产环境攻击向量，包括SKILL.md提示膨胀、持久性工具输出污染、定时任务/心跳频率放大以及行为指令注入。总体而言，本研究证明令牌耗尽攻击在实际部署中仍然可行，但其攻击规模和可观测性受到工具组合方式、恢复行为及接口设计的共同影响。