ClawHub
Back to skill

Security audit

OpenClaw Token Optimizer

Security checks across malware telemetry and agentic risk

Overview

This skill is a local token-cost optimization toolkit whose file writes are documented and user-triggered.

Install only if you want local token-budget, model-routing, and heartbeat optimization helpers. Before using the install/write commands, review the generated AGENTS.md or HEARTBEAT.md content because those files can shape future agent behavior; treat optional provider config examples as manual changes that may require third-party API keys.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill advertises executable behavior that includes file reads/writes and references to external URLs, but it does not declare explicit permissions or constraints in a machine-enforceable way. Even though the prose claims 'local-only' and 'no network requests,' the mismatch between detected capabilities and undeclared permissions creates a trust gap and can lead to overbroad access when the skill is installed or reviewed.

Session Persistence

Medium
Category
Rogue Agent
Content
Built for current OpenClaw 2026.6.x agents by [Asif2BD](https://github.com/Asif2BD) · [GitHub](https://github.com/Asif2BD/OpenClaw-Token-Optimizer) · [Security Notes](https://github.com/Asif2BD/OpenClaw-Token-Optimizer/blob/main/SECURITY.md)

> **Security notice:** local-only optimization toolkit. The Python scripts make no network requests and do not execute dynamic code. Commands that write files are explicit, documented, and backup-safe.

---
Confidence
68% confidence
Finding
write files are explicit, documented, and backup-safe. --- ## Install ```bash openclaw skills install @asif2bd/openclaw-token-optimizer ``` --- ## What's New in v3.2 ### Modern ClawHub Card The

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.