Security audit
Security checks for vulnerabilities and agentic risk
This skill reads local OpenClaw session logs to calculate token and cost summaries, which matches its stated purpose and shows no exfiltration, persistence, or destructive behavior.
Install only if you are comfortable with the skill reading your local OpenClaw session logs to compute token totals. It does not appear to send data anywhere or modify files, but users should be aware that broad trigger phrases may invoke local history scanning unless the agent asks for confirmation.
The trigger phrases are broad and generic (e.g., token统计, 费用多少, 省了多少钱), which can cause the skill to activate in contexts where the user did not explicitly consent to local session analysis. Because the skill’s documented behavior includes scanning local session files, overbroad activation increases the chance of unintended disclosure of usage history and metadata.
The skill documentation states that all data is read from ~/.openclaw/agents/main/sessions/*.jsonl, but this local filesystem access is not prominently disclosed in the top-level description or trigger metadata. Users may invoke the skill thinking it performs a harmless calculation, when it actually inspects local session history, creating a transparency and privacy risk.
Reading session transcripts from a local history directory without prominent disclosure is a privacy/security issue because users may not expect the skill to inspect stored conversations to produce its output. Even though the script appears to use usage metadata, it still opens and parses transcript files, which can contain sensitive content from prior sessions and broadens data exposure unnecessarily.
The docstring, argparse descriptions, and printed output are written in Chinese only, which imposes a specific language on users without opt-in or an alternative locale. This matches the language/locale policy concern for natural-language behavior because the skill does not offer any language selection or document a justified locale restriction.
The script scans all JSONL session logs under ~/.openclaw/agents/main/sessions, which means it accesses historical local conversation data rather than only processing explicit input passed to the tool. In a token-reporting skill, this broad transcript access creates a privacy risk because sensitive prompts, model metadata, and usage records from unrelated sessions may be processed without clear user consent or scope limitation.
The manifest describes support for two reference rate schemes: Anthropic Claude Opus 4.7 and OpenAI GPT-5.5, with Opus 4.7 as default. However, the script also exposes a --rates option that accepts any three custom pricing values, expanding behavior beyond the stated two-model scope.
No suspicious patterns detected.
