Is token-optimizer safe?
https://clawhub.ai/smartpeopleconnected/token-optimizer
Token-optimizer is a Python-based OpenClaw cost optimization tool that is functionally legitimate but exhibits concerning behavior during installation. The install phase accessed sensitive files (.env, .aws/credentials, auth-profiles.json) without justification, though no network exfiltration was detected. The skill bundles executable Python with subprocess capabilities and instructs the agent to run these commands via broad trigger phrases, creating a risk of unintended configuration changes. The optimizer.py source is truncated in evidence, preventing complete security review of the primary code-modification module.
Category Scores
Findings (13)
HIGH Sensitive file access during install: .env and AWS credentials -40 ▶
Filesystem monitoring captured ACCESS events on /home/oc-exec/.env and /home/oc-exec/.aws/credentials during the clone/install phase. While these accesses may be incidental to the OpenClaw runtime environment loading, a legitimate token optimizer skill has no reason to touch .env files or AWS credentials. The skill claims to only modify OpenClaw configuration.
HIGH Auth profiles accessed during install -25 ▶
The install phase accessed /home/oc-exec/.openclaw/agents/main/agent/auth-profiles.json which contains authentication credentials for the agent's connected services. A cost optimization tool should not need to read authentication profiles.
HIGH Install phase reads sensitive files outside skill directory -50 ▶
During clone/install, the process accessed .env, .aws/credentials, auth-profiles.json, .profile, and .bashrc — all outside the skill directory. While some of these (like .bashrc) may be normal shell initialization, the combination with .env and .aws/credentials is concerning. No network exfiltration was detected, but the data was read into process memory.
HIGH Files created outside skill directory in /tmp -20 ▶
The install phase created directories and files in /tmp/openclaw-1000/ and /tmp/jiti/. While jiti is a known JavaScript JIT compilation cache (likely from the OpenClaw runtime), the gateway.e9191928.lock file in /tmp/openclaw-1000/ indicates the skill's install triggered broader system processes.
MEDIUM Skill contains executable Python with subprocess calls -35 ▶
The skill bundles a full Python application (cli.py, src/optimizer.py, src/analyzer.py, src/verify.py) and SKILL.md instructs the agent to execute these via 'python cli.py' commands. The optimizer and verifier modules use subprocess.run() to execute shell commands (ollama list, ollama pull). This gives the skill indirect shell execution capability through the agent.
MEDIUM Incomplete source code — optimizer.py truncated -20 ▶
The optimizer.py source code is truncated in the collected evidence, cutting off at the HEARTBEAT_PROVIDERS dictionary definition. This prevents full security review of the main optimization module which is responsible for modifying user configuration files. The truncated portion could contain additional subprocess calls, file operations, or network requests.
MEDIUM HTTP requests in verify.py via urllib -10 ▶
verify.py contains urllib.request.urlopen() calls for checking provider reachability. While used for health checks, this network capability could be repurposed if the code were modified, and it normalizes outbound HTTP from within skill code.
MEDIUM Skill instructs agent to execute Python commands -15 ▶
SKILL.md's Quick Start section instructs the agent to run multiple Python CLI commands. When the skill is loaded into the agent's context via triggers, the agent may autonomously execute 'python cli.py optimize' which modifies the user's OpenClaw configuration. The broad trigger list (18 phrases) means casual mentions of cost could activate this.
MEDIUM Templates designed to replace user's agent personality files -10 ▶
The skill includes templates/SOUL.md, templates/USER.md, and templates/OPTIMIZATION-RULES.md which are intended to replace the user's existing agent configuration files in ~/.openclaw/workspace/. This could silently alter agent behavior and personality without the user's full understanding.
LOW Contradictory licensing — MIT vs paid marketplace tiers -15 ▶
MARKETPLACE.md lists pricing tiers (Personal $29.99, Team $99.99, Enterprise contact) while SKILL.md, setup.py, and skill.json all claim MIT license. This contradiction suggests either deceptive marketing or a bait-and-switch model where the free version is a gateway to paid services.
LOW Periodic donation nag embedded in verification tool -10 ▶
verify.py contains a check_benefit_report() function that displays a Ko-fi donation prompt every 7 days when the user runs verification. While not malicious, this is nag-ware behavior embedded in what appears to be a diagnostic tool.
LOW Capability downgrade risk — forces Haiku as default model -25 ▶
The optimizer forces Haiku as the default model for all tasks. While this saves money, it significantly degrades agent capability for complex reasoning tasks. Combined with broad triggers, a user casually mentioning costs could have their agent silently downgraded without understanding the capability trade-off.
INFO No network exfiltration detected 0 ▶
Despite accessing sensitive files during install, no outbound network connections were detected. The sensitive file reads did not result in data being sent externally during the monitored period.