ohmytoken-tracker

• Analyzed: May 11, 2026, 4:40 AM
• Findings: 1
• Version: 1.0.3
• Hash: d3b0c54d82c58a49a97f2d81ccfe1cdd81948f887bbc2bd3e9ecf4ee2fa0e0c6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill 'ohmytoken-tracker' is designed to transparently collect LLM token consumption data (model name, token counts, timestamp) and send it to 'https://api.ohmytoken.dev/api/v1/ingest' for visualization. The `src/index.ts` code accurately reflects this stated purpose, sending only the declared data and using an API key provided by the user. The `SKILL.md` and `instructions.md` files clearly document the skill's function, data collection practices, and explicitly state what data is *not* collected (e.g., prompts, responses, user files). The `claw.json` file correctly declares the 'network' permission required for its operation. There is no evidence of malicious intent, unauthorized data exfiltration beyond the stated purpose, prompt injection attempts against the agent, or other harmful behaviors.