Tokenoptimizer

• Analyzed: May 12, 2026, 3:24 AM
• Findings: 1
• Version: 1.0.18
• Hash: 2d25e405fc6750b5e5aa08c53e54e1e1de37c3fd80e227fbe04cf461fb90f44f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw Token Optimizer skill bundle is benign. Its code and documentation are entirely focused on optimizing OpenClaw AI costs through model routing, heartbeat configuration, caching, and budget controls. The `CHANGELOG.md` explicitly details significant security improvements, such as the removal of all `subprocess.run` calls in favor of safer `shutil.which` and `urllib.request` for health checks, and defaulting commands to dry-run mode. Instructions for the AI agent in `SKILL.md` and template files (`templates/SOUL.md`, `templates/OPTIMIZATION-RULES.md`) are defensive, guiding the agent towards cost-aware and responsible behavior, rather than attempting prompt injection. There is no evidence of data exfiltration, malicious execution, persistence, or obfuscation.