AllToken

PassAudited by VirusTotal on May 13, 2026.

Overview

Type: OpenClaw Skill Name: alltoken Version: 1.0.0 The 'alltoken' skill is a comprehensive bootstrap template for building AI agents integrated with the alltoken.ai API. The provided code (SKILL.md) follows security best practices, such as implementing a custom shunting-yard algorithm for calculations to avoid using 'eval()' and recommending environment variables for API key management. No evidence of data exfiltration, malicious execution, or prompt injection was found; the skill functions as a legitimate scaffolding tool for developers.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone running the generated project with this key can make AllToken API calls and spend associated credits.

Why it was flagged

The skill uses a provider API key to authenticate to AllToken. This is expected for the integration, but it is a sensitive credential and can consume account credits.

Skill content

**Auth header:** `Authorization: Bearer $ALLTOKEN_API_KEY`

Recommendation

Use a revocable AllToken key from the environment only, avoid committing it, and confirm the account/billing scope before running smoke tests or generated apps.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The generated project will depend on packages downloaded from npm at install time.

Why it was flagged

The bootstrap flow installs third-party npm dependencies without pinned versions. This is normal for a scaffolding recipe, but it introduces standard package supply-chain exposure.

Skill content

npm install openai zod eventemitter3
npm install ink react        # optional: TUI only
npm install -D typescript @types/react tsx

Recommendation

Review dependencies, generate and keep a lockfile, and pin versions if reproducibility or stricter supply-chain control is important.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Prompts, tool requests, and media-generation inputs sent through the generated client will leave the local environment for AllToken's service.

Why it was flagged

The generated client is designed to send chat, image, video, and model-discovery requests to AllToken's API. The destination is clearly disclosed and matches the skill purpose.

Skill content

**Base URL:** `https://api.alltoken.ai/v1`

Recommendation

Do not send secrets or private data unless you intend to share them with AllToken under its service terms.