Token Manager

• Analyzed: May 12, 2026, 3:51 AM
• Findings: 1
• Version: 1.2.0
• Hash: ddda944f50dd7abaea20978f9453d94bca00d24949c64a7f83af168b25f834b5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle 'token-manager' is classified as benign. All code (`scripts/manager.js`, `scripts/scheduler.js`, `scripts/session-tracker.js`) and documentation (`SKILL.md`) align with the stated purpose of an LLM token manager. API keys are correctly handled via environment variables, data is stored locally in the `.data/` directory, and network requests are exclusively directed to official LLM API endpoints (e.g., api.moonshot.cn, api.openai.com). While the skill utilizes the `openclaw cron add` command for scheduled monitoring, this is a legitimate feature used for its declared purpose and does not indicate malicious persistence. No evidence of data exfiltration, malicious execution, obfuscation, or prompt injection attempts to subvert the agent's control or steal sensitive information was found.