Prompt Token Counter
v1.0.11Count tokens and estimate costs for 300+ LLM models. Primary use: audit OpenClaw workspace token consumption (memory, persona, skills).
⭐ 0· 270·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description align with the code and instructions. The skill explicitly targets counting tokens and auditing OpenClaw workspace components (AGENTS.md, SOUL.md, SKILL.md, etc.), which explains why it reads those files and provides model pricing/registry data.
Instruction Scope
SKILL.md and the CLI explicitly instruct reading files under ~/.openclaw/workspace and ~/.openclaw/skills to perform an audit — this is sensitive but coherent with the stated audit purpose. The CLI also supports HTTP(S) fetches (urllib.request.urlopen) but SKILL.md mandates asking the user and confirming trust before any URL is fetched. Verify the runtime agent actually enforces that confirmation rather than auto-invoking URL fetches.
Install Mechanism
No install spec is provided (instruction-only install path), so there is no remote download/install mechanism to review. The package contains Python source files bundled with the skill; there are no external installers or obscure download URLs.
Credentials
The skill declares no required environment variables or credentials. Some example scripts reference optional API_KEY/BASE_URL and the README notes optional tiktoken for exact OpenAI counts — these are optional and used only for benchmarking/API mode. There is no unexplained request for unrelated secrets.
Persistence & Privilege
always is false and the skill does not request permanent platform privileges. Autonomous invocation is allowed by default (normal), but there are no indicators this skill modifies other skills or global configs.
Assessment
This skill appears internally consistent with its purpose, but it legitimately reads sensitive OpenClaw workspace files (AGENTS.md, SOUL.md, MEMORY.md, SKILL.md, etc.). Before installing: (1) review scripts/cli.py and scripts/core.py if you are concerned about data flow; (2) run the CLI locally in an isolated environment against test files to confirm behavior; (3) do not allow URL fetches unless you explicitly confirm each URL (the SKILL.md requires confirmation — ensure the agent follows that); (4) you only need to provide API keys if you intentionally run the example 'API mode' benchmark (otherwise no credentials are required); (5) if your workspace contains secrets, avoid installing or run the tool on a copy of the workspace. If you want stronger assurance, ask the maintainer for a signed release or audit the code paths that read ~/.openclaw/openclaw.json and the workspace to confirm there is no unexpected network exfiltration.Like a lobster shell, security has layers — review code before you run it.
latestvk976exmzmqyphtcy7kpsd5618s831kym
License
MIT-0
Free to use, modify, and redistribute. No attribution required.