OpenClaw Token Optimizer

PassAudited by ClawScan on May 1, 2026.

Overview

This looks like a local cost-saving helper, but it can persistently change how your agent loads context and picks models.

Install if you want a local token/cost optimizer, but run the scripts manually, review generated AGENTS.md or HEARTBEAT.md changes before replacing existing files, verify any referenced optional assets, and be aware that provider API-key environment variables may be checked for routing.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

If adopted without review, future sessions may skip useful docs or memory until a trigger is detected, which could reduce answer quality or miss important workspace context.

Why it was flagged

The generated AGENTS.md template can direct future agents to load less context and enforce cheaper models if the user chooses to install it.

Skill content
**Stop there.** Don't load anything else unless needed. ... **Simple conversations → HAIKU ONLY**
Recommendation

Review AGENTS.md.optimized before replacing your current AGENTS.md, and keep any safety, workflow, or required context files explicitly listed as always loaded.

What this means

Optional setup steps that depend on those files may fail or may require checking files outside the scanned bundle.

Why it was flagged

The integrity manifest references assets and reference files that are not included in the provided file manifest, while the docs also describe using those optional files.

Skill content
assets/config-patches.json ... assets/HEARTBEAT.template.md ... references/PROVIDERS.md
Recommendation

Verify the installed package contents and source repository before copying optional assets or applying referenced configuration patches.

What this means

The script can observe whether common provider credential variables exist, though the provided code does not show it printing or transmitting their values.

Why it was flagged

The router checks for provider API-key environment variables to infer which model provider to recommend, despite no required env vars being declared.

Skill content
if os.environ.get("ANTHROPIC_API_KEY"): return "anthropic" ... elif os.environ.get("OPENROUTER_API_KEY"): return "openrouter"
Recommendation

Run it only in environments where checking these provider env vars is acceptable, and avoid exposing unnecessary credentials to agent sessions.

What this means

Local usage metadata can accumulate over time and influence optimization decisions, but the artifacts show local storage rather than external sharing.

Why it was flagged

The optimizer persists local file-usage metadata that may inform future context-loading recommendations.

Skill content
STATE_FILE = Path.home() / ".openclaw/workspace/memory/context-usage.json" ... state["file_access_count"]
Recommendation

Periodically review or delete the workspace memory state files if you do not want historical file-usage metadata retained.