Openclaw Token Memory Optimizer

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is mostly a disclosed, user-directed guide for reducing OpenClaw context size, with the main caution being optional indexing of local memory and past conversation transcripts.

Before installing or following the examples, verify the source, apply configuration changes manually, start with narrow memorySearch paths, avoid indexing sensitive session logs by default, and review any cron jobs so background agent activity stays intentional.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Old conversation details or incorrectly summarized facts may be reused later by the agent.

Why it was flagged

The skill asks users to persist summarized facts and optionally index OpenClaw session transcripts for later retrieval. This is aligned with the RAG/memory purpose, but it means private or stale conversation content can influence future responses.

Skill content
"Update MEMORY.md: Append these new facts to your long-term memory file" ... "extraPaths": ["~/.openclaw/sessions/*.jsonl"]
Recommendation

Index only the memory and session files you actually want reused, review MEMORY.md before relying on it, and avoid indexing sensitive transcripts unless you are comfortable with them being searchable.

What this means

If copied without review, scheduled agent tasks could run repeatedly or send results back to the main channel more often than intended.

Why it was flagged

The skill documents recurring background agent tasks. The behavior is disclosed and purpose-aligned for isolating cron jobs, but recurring agent turns should remain explicitly user-controlled.

Skill content
"cron.jobs" ... "schedule": { "kind": "every", "everyMs": 1800000 }, "sessionTarget": "isolated", "payload": { "kind": "agentTurn" ... "deliver": true }
Recommendation

Review cron schedules, payload messages, and delivery settings before applying examples, and keep only background jobs you intentionally want running.

What this means

Users have less external context for verifying who maintains the skill or whether the package matches an upstream repository.

Why it was flagged

The registry metadata does not identify a source or homepage. The included artifacts do not show malicious install behavior, but the provenance is limited.

Skill content
Source: unknown; Homepage: none
Recommendation

Install from a trusted registry entry, verify the publisher/source if possible, and inspect changes before applying configuration examples.