by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly does what it says (local analysis of session logs) and has no obvious network/exfil code, but there are inconsistencies between the documentation and the actual script plus a few unimplemented/fragile behaviors that could mislead users.
评估建议
This skill appears to be a local cost-analysis tool and does not contain network calls, external installs, or credential requests — but review before use:
- Verify which session-log path your OpenClaw actually uses. The documentation claims ~/.openclaw/agents/main/agent/sessions/*.jsonl, but the script reads ~/.openclaw/workspace/memory/conversations. If these don't match, the script will find no logs. Update CONFIG.logsDir in scripts/cost_analyzer.js or adjust where your logs are stored.
- In...详细分析 ▾
ℹ 用途与能力
The name/description (cost analysis & optimization) matches the provided script: the Node.js script reads local logs, computes token/cost stats, and writes a report. No unrelated credentials or network access are requested. However, the SKILL.md and Security.md claim a different session-log path (~/.openclaw/agents/main/agent/sessions/*.jsonl) while the script's CONFIG.logsDir points to ~/.openclaw/workspace/memory/conversations — this mismatch will likely make the tool miss real logs unless paths are reconciled.
⚠ 指令范围
SKILL.md instructs reading session logs and only local operations, which the script follows, but there are several scope issues: the logs path in docs differs from the script's path; the script marks cron detection as TODO (session.isCron stays false), so cron analysis is incomplete; SKILL.md suggests shell commands (find -delete) and other openclaw/ollama CLI commands as manual actions — those are user actions but could be destructive if copy-pasted without caution. The instructions also reference other skills (openclaw-token-optimizer) without guaranteeing their presence.
✓ 安装机制
No install spec; this is effectively an instruction-only skill with a script file. That minimizes installer risk. The script uses only Node built-ins (fs, path, os) and there's no install-step downloading external code.
✓ 凭证需求
No environment variables, no credentials, and no external endpoints are requested. The script only reads local files and writes a report to the user's workspace directory.
✓ 持久化与权限
always:false and no attempt to modify other skills or global config. The script writes a report into the user's memory workspace only. It does not persist credentials or alter agent configuration.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/26
初始版本：完整成本分析、高消耗场景识别、优化建议生成
● 无害
安装命令
点击复制官方npx clawhub@latest install openclaw-cost-analyzer
镜像加速npx clawhub@latest install openclaw-cost-analyzer --registry https://cn.longxiaskill.com