Optimizer Openclaw Token

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a local token-cost optimizer, but its documentation and wrapper include risky, under-disclosed actions that users should review before installing.

Install only after reviewing the RTK companion instructions and the workspace files this skill may write. Avoid the curl | sh RTK installer unless you independently trust and verify it, back up any existing HEARTBEAT.md before using the heartbeat command, and treat the bundled security assurances as overstated because the package does perform local workspace writes and lacks the referenced checksum manifest.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:93

Finding

Unpinned Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:93-97
• references/RTK.md:18-22

Vulnerability Type: Supply-chain remote code execution through mutable remote content
Risk Level: High

Complete Vulnerable Code Snippets:

README.md:93-97

bash

Linux/macOS quick install:

```bash
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

text

`references/RTK.md:18-22`
```bash
### Linux/macOS Quick Install

```bash
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

text

### Technical Analysis

The instructions retrieve an installation script from the mutable `master` branch of an external GitHub repository and immediately pass the response to `sh`. The downloaded content is not pinned to an immutable commit or release, displayed for review, or authenticated using a checksum or cryptographic signature.

Consequently, the effective executable payload may change after this Skill has been reviewed. Compromise of the external repository, maintainer account, branch, release process, or delivery path could turn this documented command into arbitrary code execution.

RTK is explicitly described as an optional companion. Installing it is not required for OOT's core context optimization, model routing, heartbeat scheduling, or local budget tracking. Direct remote execution therefore exceeds the minimum privileges and dependencies needed by the Skill itself.

### Attack Path

1. An attacker compromises the `rtk-ai/rtk` repository, a maintainer account, or another mechanism capable of changing `install.sh` on the `master` branch.
2. The attacker adds commands to the installer to steal credentials, alter shell initialization, install persistence, or execute another payload.
3. A user follows the installation command from `README.md` or `references/RTK.md`.
4. `curl` retrieves the attacker's current script without pres
...[truncated 902 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl | sh installation instructions.
2. Prefer a trusted package manager with version pinning where available.
3. If direct download is necessary:
   • Pin the URL to an immutable release or commit.
   • Download the file without executing it.
   • Publish and verify a SHA-256 checksum or cryptographic signature.
   • Ask the user to inspect the script before running it.
   • Execute the verified local file as a separate command.
4. Document RTK as optional and clearly separate it from the minimum OOT installation path.
5. Avoid recommending global initialization until its generated hooks and modified files have been disclosed and reviewed.
6. Apply the same remediation consistently in both README.md and references/RTK.md.

A safer pattern is:

bash

curl -fL -o rtk-install.sh "https://example.invalid/immutable-release/install.sh"
echo "EXPECTED_SHA256  rtk-install.sh" | sha256sum -c -
less rtk-install.sh
sh rtk-install.sh

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/optimize.sh:45

Finding

Heartbeat Installation Silently Overwrites a Persistent Workspace Policy

Content

View full analysis

Vulnerability Details

File Location: scripts/optimize.sh:45-48
Related Instructions:

• SKILL.md:59-62
• README.md:178-182
• Installed policy content: assets/HEARTBEAT.template.md:3-49

Vulnerability Type: Unsafe overwrite of persistent Agent configuration
Risk Level: Medium

Complete Vulnerable Code Snippet:

bash

heartbeat|hb)
    DEST="${HOME}/.openclaw/workspace/HEARTBEAT.md"
    cp "$SCRIPT_DIR/../assets/HEARTBEAT.template.md" "$DEST"
    echo "Installed optimized heartbeat to: $DEST"
    ;;

The copied template includes persistent behavioral directives such as:

markdown

## 🔥 Model Override (CRITICAL!)
**This heartbeat should ALWAYS run on Haiku** — never Sonnet/Opus.

Set model override for this session:

session_status model=anthropic/claude-haiku-4

text

Technical Analysis

Invoking the heartbeat command copies the bundled template directly over ~/.openclaw/workspace/HEARTBEAT.md. The operation does not:

• Check whether the destination already exists.
• Request confirmation.
• Create a backup.
• Display a diff.
• Use an explicit force option.
• Perform an atomic, recoverable update.

HEARTBEAT.md is not merely disposable state: it controls future heartbeat behavior, including model selection, quiet hours, monitoring frequency, and which checks should be performed. The replacement therefore has persistent behavioral effects across later heartbeat sessions.

The template's content is consistent with OOT's declared optimization purpose, and no unrelated backdoor instruction was found. The vulnerability is the unguarded replacement of an existing policy, not the mere existence of a heartbeat template.

Attack Path

1. A workspace already contains a customized HEARTBEAT.md with monitoring or alerting requirements.
2. The user invokes ./scripts/optimize.sh heartbeat, potentially relying on documentation describing the wra ...[truncated 1084 chars]

Remediation

View remediation

Remediation Suggestions

1. Refuse to overwrite an existing HEARTBEAT.md by default.
2. Require an explicit --force option for replacement.
3. Create a timestamped backup before any forced overwrite.
4. Offer a merge or diff workflow rather than replacing the entire policy.
5. Write to a temporary file and use an atomic rename after validation.
6. Ensure the destination directory exists and report failures accurately.
7. Update the documentation to state that this command modifies persistent workspace behavior.

Example hardening:

bash

DEST="${HOME}/.openclaw/workspace/HEARTBEAT.md"
SRC="$SCRIPT_DIR/../assets/HEARTBEAT.template.md"

mkdir -p "$(dirname "$DEST")"

if [ -e "$DEST" ] && [ "${2:-}" != "--force" ]; then
    echo "Refusing to overwrite existing file: $DEST"
    echo "Review the template and rerun with --force if replacement is intended."
    exit 1
fi

if [ -e "$DEST" ]; then
    cp -- "$DEST" "${DEST}.backup.$(date +%Y%m%d%H%M%S)"
fi

TMP="${DEST}.tmp.$$"
cp -- "$SRC" "$TMP" && mv -- "$TMP" "$DEST"

other

Note

• Location: SECURITY.md:44

Finding

Security Documentation Contains Materially Inaccurate Assurance Claims

Content

View full analysis

Vulnerability Details

File Locations:

• SECURITY.md:44-60
• SECURITY.md:236-255
• SECURITY.md:271-278
• SKILL.md:3-16

Vulnerability Type: Misleading security and integrity documentation
Risk Level: Low

Relevant Code and Documentation Snippets:

SECURITY.md:44-60

markdown

`scripts/optimize.sh` is a **convenience CLI wrapper** — it does nothing except call the bundled Python scripts in this same directory. It is not an installer, not a downloader, and makes no network calls.

**What it does (complete source):**
```bash
case "$1" in
    route|model)   python3 "$SCRIPT_DIR/model_router.py" "$@" ;;
    context)       python3 "$SCRIPT_DIR/context_optimizer.py" generate-agents ;;
    recommend)     python3 "$SCRIPT_DIR/context_optimizer.py" recommend "$2" ;;
    budget)        python3 "$SCRIPT_DIR/token_tracker.py" check ;;
    heartbeat)     cp "$SCRIPT_DIR/../assets/HEARTBEAT.template.md" ~/.openclaw/workspace/HEARTBEAT.md ;;
esac

Security properties:

• ✅ No network requests
• ✅ No system modifications

text

`SECURITY.md:271-278`
```markdown
Every file in this skill bundle is listed in `.clawhubsafe` with its SHA256 checksum. Verify integrity at any time:
```bash
cd ~/.openclaw/skills/oot
sha256sum -c .clawhubsafe

The README references the GitHub repo for users who want to review the source before installing. That link is informational — nothing in the skill auto-downloads from it.

text

`SKILL.md:3`
```yaml
description: Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session pruning, bootstrap size limits, cache TTL alignment). Use when token costs are high, API rate limits are being hit, or hosting multiple agents at scale. The 4 executable scripts (context_optimizer, model_router, heartbeat_optimizer, token_tracker) are local-only — no network requests, n
...[truncated 2378 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “no system modifications” with a precise inventory of all writes:
   • ~/.openclaw/workspace/memory/context-usage.json
   • ~/.openclaw/workspace/memory/heartbeat-state.json
   • ~/.openclaw/workspace/memory/token-tracker-state.json
   • ~/.openclaw/workspace/AGENTS.md.optimized
   • ~/.openclaw/workspace/HEARTBEAT.md
2. Explicitly disclose that the heartbeat command may replace an existing persistent policy.
3. Document the RTK installer as third-party remote code execution rather than an informational link.
4. Remove the .clawhubsafe claim unless the manifest is actually shipped and maintained.
5. If a manifest is added, ensure it covers every distributed file and document how the manifest itself is authenticated.
6. Remove unsupported verified: true assertions or identify the audit scope, methodology, artifact hash, auditor identity, and limitations.
7. Keep metadata, README instructions, wrapper behavior, and security documentation synchronized through release checks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (36)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh construct turns a documentation example into immediate code execution from untrusted remote content, removing the user's opportunity to inspect what will run. In skill context, this is more dangerous because users may copy/paste setup steps while installing tooling, making exploitation straightforward if the upstream script is modified maliciously.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

Linux/macOS quick install:

bash

curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

Cargo:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 202)May include surrounding context.

grep -r "urllib|requests|http|socket|download|fetch" scripts/

Search for system modifications (should return nothing)

grep -r "rm -rf|sudo|chmod 777|chown" .

text

### Review Imports

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documentation frames the skill as a local-only toolkit with limited behavior, but it also instructs users to copy templates into home-directory workspace locations and references wrapper/companion workflows not clearly reflected in the declared behavior model. That inconsistency weakens user trust boundaries and can cause security reviewers or operators to underestimate the extent of file modifications the skill encourages.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation frames the skill as a local-only toolkit with limited behavior, but it also instructs users to copy templates into home-directory workspace locations and references wrapper/companion workflows not clearly reflected in the declared behavior model. That inconsistency weakens user trust boundaries and can cause security reviewers or operators to underestimate the extent of file modifications the skill encourages.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

Update check interval (seconds)

heartbeat_optimizer.py interval email 7200 # 2 hours

Reset state

heartbeat_optimizer.py reset

text

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/heartbeat_optimizer.py (reported line 287)May include surrounding context.

python

# Update check interval (seconds)
heartbeat_optimizer.py interval email 7200  # 2 hours

# Reset state
heartbeat_optimizer.py reset
```

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh chain removes the user's opportunity to inspect the downloaded content and executes whatever bytes are returned as shell commands. In skill context, this is more dangerous because the file is operational guidance for agent users, making copy-paste execution of unreviewed install commands more likely.

Content

Scanner excerpt · references/RTK.md (reported line 21)May include surrounding context.

Linux/macOS Quick Install

bash

curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

Cargo

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest states the four executable scripts are local-only and make no network requests, while this PR description adds 'Automatic failover to Ollama when cloud APIs fail' and references Ollama integration as a new capability. Even though this file is documentation, it describes behavior beyond the manifest's stated operational scope and suggests a broader model-routing/fallback behavior than the manifest allows for the executables.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README recommends executing a remote installation script directly from GitHub via a shell pipeline, without any warning to inspect or verify the script first. This creates a supply-chain execution risk: if the remote content, repository, or transport path is compromised, users may run attacker-controlled code on their system immediately.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 92)May include surrounding context.

md

- ✅ No network requests
- ✅ No code execution (no eval, exec, compile)
- ✅ Only standard library imports: `json, re, pathlib, datetime`
- ✅ Read/write permissions limited to OpenClaw workspace
- ✅ No subprocess calls
- ✅ No system modifications

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 202)May include surrounding context.

grep -r "urllib|requests|http|socket|download|fetch" scripts/

Search for system modifications (should return nothing)

grep -r "rm -rf|sudo|chmod 777|chown" .

text

### Review Imports

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

The skill explicitly states it can read and write JSON files in the OpenClaw workspace, which is a real persistence capability. While this appears aligned with the skill's stated function and not inherently malicious, any writable persistent state can be abused for tampering, stale-state manipulation, or storing sensitive data if inputs are not controlled elsewhere in the implementation.

Content

Scanner excerpt · SECURITY.md (reported line 244)May include surrounding context.

md

## Threat Model

**What this skill CAN do:**
- Read/write JSON files in OpenClaw workspace
- Analyze text for complexity classification
- Generate markdown templates
- Provide recommendations via stdout

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SECURITY.md (reported line 250)May include surrounding context.

md

- Provide recommendations via stdout

**What this skill CANNOT do:**
- Execute arbitrary code
- Make network requests
- Modify system files outside workspace
- Access sensitive data

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 252)May include surrounding context.

md

**What this skill CANNOT do:**
- Execute arbitrary code
- Make network requests
- Modify system files outside workspace
- Access sensitive data
- Run system commands
- Spawn subprocesses

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

→ Savings: ~80% of context

# Standard work → selective loading
context_optimizer.py recommend "write a function"
→ Load: SOUL.md, IDENTITY.md, memory/TODAY.md
→ Skip: docs, old memory, knowledge base
→ Savings: ~50% of context

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Mandating a specific model override without user approval changes execution characteristics and can bypass user or platform routing policy. While primarily a policy and governance issue rather than direct code execution risk, it can reduce transparency, interfere with safety or quality expectations, and normalize hidden configuration changes in prompt content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file claims a local-only token-optimization purpose, but the template directs activities that typically require external APIs, mailbox access, calendar access, weather services, or host monitoring. This mismatch can mislead users and downstream systems about the true privileges and data flows involved, undermining trust boundaries and safe deployment assumptions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat template instructs an agent to check email, calendar, weather, and server monitoring data, which expands behavior beyond the skill's stated token-optimization scope. Those actions can drive access to sensitive data sources or external services, creating capability creep and increasing the chance of unauthorized data access or unintended network/system interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation recommends piping a remotely fetched script directly into sh without any warning, integrity verification, or review step. This is dangerous because whoever controls the upstream content, transport, or repository branch can cause arbitrary code execution on the user's machine at install time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest frames the executable scripts as local-only optimizers and explicitly says they make no system modifications. However, this script persists usage data by creating directories and writing context-usage.json under ~/.openclaw/workspace/memory, which is a state-changing file system modification rather than a purely advisory analysis operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes context optimization features, but this command materially writes a new workspace instruction file at ~/.openclaw/workspace/AGENTS.md.optimized. That behavior goes beyond analyzing/minimizing context and crosses into authoring workspace configuration content, which is not clearly disclosed in the manifest's stated scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the executable scripts are local-only and positions this script as a cost/router helper, not as a component that inspects credential-bearing environment variables. This file auto-detects providers by reading ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, and OPENROUTER_API_KEY from the process environment, which expands its capability into credential discovery rather than pure prompt classification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs a filesystem write by copying a template into ~/.openclaw/workspace/HEARTBEAT.md, which contradicts the skill metadata claim that the executable scripts make no system modifications. This mismatch can mislead users or higher-level agents into granting the skill more trust than warranted, and the write occurs without confirmation, backup handling, or checks that the destination is safe to overwrite.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

Line L10 describes failover behavior tied to cloud API failure scenarios, including network problems, while L12 broadly claims the mode 'works offline.' As written, the documentation conflates an offline local mode with a cloud-failure-triggered routing feature, which can mislead readers about what is actually required and when the behavior occurs.

Content

No source excerpt is available for this finding.