ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Token Optimization

v1.0.0

Reduce unnecessary token usage with the current production-proven workflow. Use when users ask to optimize token consumption, reduce prompt/context bloat, st...

⭐ 0· 102·0 current·0 all-time
by@sinoslug

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sinoslug/token-optimization-sinoslug.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Token Optimization" (sinoslug/token-optimization-sinoslug) from ClawHub.
Skill page: https://clawhub.ai/sinoslug/token-optimization-sinoslug
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install token-optimization-sinoslug

ClawHub CLI

Package manager switcher

npx clawhub@latest install token-optimization-sinoslug
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name and description align with the included ruleset (short answers, log trimming, token counting). However, the shipped spec refers to an external helper script and state files used in production; these resources are not declared in the skill metadata (no required binaries, no config paths). That omission is inconsistent with the runtime needs implied by the spec.
!
Instruction Scope
SKILL.md (via references/current-spec.md) instructs the agent to execute a local command: `python3 /home/admin/.openclaw/workspace/scripts/token-show.py` and to read state files such as `memory/token-agg-state.json` and `memory/token-counter.json`. Those are explicit file-system and command actions outside of the skill bundle and were not declared. The skill therefore directs actions on local files and execution of local code that the user cannot audit from the skill package itself.
ℹ
Install Mechanism
There is no install spec (instruction-only), which lowers surface risk, but the spec implicitly depends on files and a script existing on the host. The skill does not include the referenced script or explain how it is installed, creating a hidden dependency.
!
Credentials
The skill declares no required environment variables or config paths, yet the runtime spec expects access to `/home/admin/.openclaw/...` and `memory/*.json` paths and execution of `python3`. This mismatch is disproportionate: either the metadata should declare those config paths and the binary requirement, or the instructions should avoid requiring local privileged paths.
✓
Persistence & Privilege
The skill does not request always-on presence (always: false) and does not change other skills' configs. Autonomous invocation is allowed (platform default). There is no explicit request for persistent installation or elevated privileges in the metadata.
Scan Findings in Context
[no-regex-findings] expected: The regex-based scanner found nothing to analyze because this is an instruction-only skill. However, the included references file contains paths and commands that the scanner could not validate for safety.
What to consider before installing
Before installing or enabling this skill, verify the following: (1) Ask the skill author to provide the exact contents of /home/admin/.openclaw/workspace/scripts/token-show.py and any referenced state files so you can review what will be executed and read. (2) Confirm whether token-show.py makes network calls or writes/reads sensitive data; if it does, require explicit disclosure and least-privilege controls. (3) Update the skill metadata to declare required binaries (python3) and required config paths, or change the SKILL.md to avoid executing undocumented local scripts. (4) If you cannot review the script, run the skill in a constrained sandbox or deny file-execution until you can audit it. These steps reduce the risk of hidden data access or unwanted code execution.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c13awt02hncdamnagqhjyss848skw
102downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0
@sinoslug
latest
Download

Token Optimization

Use this skill when the task is about reducing token usage while keeping answer quality stable.

Workflow

  1. Read the current baseline spec first:
    • references/current-spec.md
  2. Apply only the already-implemented rules from that file.
  3. Do not introduce speculative or not-yet-implemented optimization tactics.
  4. If asked to change behavior, update the spec and version it.

Scope guard

  • In scope: concise reply behavior, log/tool-output trimming, current token-show usage flow, and currently active execution process.
  • Out of scope: future ideas not yet implemented (auto-threshold switching, automatic split replies, weekly auto-reviews), unless user explicitly requests a new version update.

Output expectation

When asked to explain or sync the optimization plan, provide the “current-state only” version and cite that it follows references/current-spec.md.

Comments

Loading comments...