Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local token-cost analyzer that reads usage logs and does not show evidence of hidden data sharing or unsafe persistence.
Before installing, understand that the skill will read local usage-log files you provide or that match its documented auto-detect paths. Confirm the log path is really an OpenClaw usage log, treat dollar figures as estimates unless you supply current pricing, and only set up recurring budget checks deliberately.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules.append((k.lower(), (float(v["input"]), float(v["output"]))))
else:
rules.append((k.lower(), (float(v[0]), float(v[1]))))
return rules
return DEFAULT_PRICES
The skill instructs the agent to read local usage logs and potentially environment-configured paths, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization gap: an orchestrator or reviewer cannot easily constrain which files or environment-derived locations the skill may access, increasing the risk of unintended local data exposure if the log path or autodetection reaches sensitive files.
The phrase "Any time cost or usage comes up" is broad and could match ordinary conversation beyond a deliberate request to use this skill. Although examples are provided, the activation condition itself lacks clear boundaries or exclusion criteria for when the skill should not be invoked.
No suspicious patterns detected.