caveman-claw
Security checks across malware telemetry and agentic risk
Overview
The plugin's code and runtime instructions match its claim to compress assistant history, inject short system instructions, and track token savings; nothing requested or installed is disproportionate to that purpose, though it does modify local files and auto-activate by default which you should be aware of.
This skill appears to do exactly what it says: compress assistant history, inject brief system instructions, and track savings. Before enabling it consider: (1) the default config turns 'caveman mode' on for every new session — set globalByDefault:false if you prefer opt-in; (2) the /cc compress command rewrites files in-place (it creates a '.original.md' backup, but test carefully on important docs); (3) the plugin writes savings and session state to its local data/ directory inside the plugin install path; (4) it reads your OpenClaw config (~/.openclaw/openclaw.json and models.json) only to estimate pricing. If you want extra caution, review the repository locally, run it in a test agent or disable globalByDefault before enabling, and back up any files you might compress.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings
