Clawculator

PassAudited by ClawScan on May 10, 2026.

Overview

Clawculator appears purpose-aligned and offline, but it reads local OpenClaw configuration/session cost data and writes a local report, so users should review the report and any suggested fix commands before acting.

Clawculator looks coherent for offline OpenClaw cost analysis. Before installing, be aware that it reads your local OpenClaw configuration and session usage, writes a markdown report by default, and may include commands that modify or delete OpenClaw state if you choose to run them. Review the report before sharing it and approve any fix commands manually.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The report may reveal details about your OpenClaw setup, models, costs, and session activity to the agent/chat where it is returned.

Why it was flagged

The skill needs these files for cost analysis, but they are local account/configuration and session-usage data that may be sensitive.

Skill content
**Files this skill reads:**
- `~/.openclaw/openclaw.json` — your OpenClaw config
- `~/.openclaw/agents/main/sessions/sessions.json` — session token usage
Recommendation

Install only if you are comfortable giving the skill read access to your OpenClaw cost/config/session data, and avoid sharing the generated report publicly without reviewing it.

What this means

A cost/config/session summary can remain in your working directory and may later be read or shared by you or an agent.

Why it was flagged

The --md path used by the SKILL invocation persists the generated analysis to a local markdown file.

Skill content
const outPath = flags.out || path.join(process.cwd(), 'clawculator-report.md');
fs.writeFileSync(outPath, generateMarkdownReport(analysis), 'utf8');
Recommendation

Review the generated `clawculator-report.md`, store it somewhere appropriate, and delete it if you do not want a persistent local cost report.

What this means

If a user or agent blindly runs suggested commands, it could change OpenClaw configuration or remove session state.

Why it was flagged

The analyzer can include operational fix commands in the report, including a command that deletes a session file; the artifacts show this as advice, not automatic execution.

Skill content
ORPHANED_SESSIONS: {
    fix: 'Delete sessions.json to clear orphaned sessions — they auto-rebuild on next use',
    command: 'rm ~/.openclaw/agents/main/sessions/sessions.json',
  }
Recommendation

Treat generated fix commands as recommendations. Review them and back up important files before running any configuration-changing or deletion command.

What this means

Installing the skill allows your agent to run the bundled analyzer when you ask for a cost report.

Why it was flagged

The skill executes bundled local JavaScript via node, which is central to its stated purpose and disclosed in the instructions.

Skill content
When the user types `clawculator`, `check my costs`, `analyze spend`, or `cost report`, run:

```bash
node {baseDir}/run.js --md
```
Recommendation

This is expected for this skill; audit the bundled JavaScript if you need high assurance before running it.