Api Cost Optimizer
Analysis
This skill appears to be a read-only local cost analysis tool, with minor transparency issues around local config access and an undeclared utility dependency.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
HB_CALLS_DAY=$(echo "86400 / $HEARTBEAT_INTERVAL" | bc)
The scripts rely on the bc command for calculations, but the declared required binaries list only curl and python3. This is an incomplete dependency declaration rather than evidence of malicious behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
CONFIG_FILE="${HOME}/.openclaw/openclaw.json" ... AGENT_CONFIG="${HOME}/.openclaw/agents/*/agent.json"The script reads local OpenClaw configuration and agent configuration files to detect heartbeat settings. This is purpose-aligned and read-only, but users should be aware it inspects local agent configuration.