Token Consumer Optimizer

This package looks like a legitimate cost-optimizer in intent but contains inconsistencies and one risky pattern. Before running or installing: - Do not run install.sh or any Python scripts as root. Run in an isolated environment (container or VM) first. - Inspect optimizer_v2.py: it inserts '/root/.openclaw/workspace/token-ecosys-core' into sys.path and imports modules from there. Ask the author why it needs to load code from that absolute workspace path; this could cause it to execute arbitrary local code present on the host. If you don't control that workspace, treat this as a red flag. - Confirm entrypoint and API behavior: manifest.entry is optimizer_v2.py but main.py and tests reference classes/functions that optimizer.py doesn't define. Ask for a clear, single entrypoint and for tests to pass. - If you need the functionality, run the included unit tests in a sandbox to reproduce expected behavior. The tests expect a TokenConsumerOptimizer class (not present in optimizer.py) — request corrected code or a working release. - If you plan to use any network features (real-time pricing/API), ask what endpoints are contacted and what credentials are required; do not provide tokens or credentials until you verify the caller and TLS endpoints. What would change this assessment: a corrected/single coherent entrypoint, removal of absolute sys.path insertion (or clear explanation/justification and a safer mechanism), and code that implements or documents real-time fetching and any required credentials. Until then treat the package as suspicious and run it only in an isolated environment.