Reduce OpenClaw AI costs by 97%. Haiku model routing, free Ollama heartbeats, prompt caching, and budget controls. Go from $1,500/month to $50/month in 5 min...
Security Analysis
high confidenceThe skill's code, instructions, and requested access are coherent with its stated purpose (modifying OpenClaw config under ~/.openclaw, preview-by-default, optional heartbeat checks); it does not request credentials or perform obvious exfiltration.
The skill claims to optimize OpenClaw configs and the code operates on ~/.openclaw/openclaw.json, backups, workspace and prompts as described. It adds model routing, heartbeat configuration, caching and budgets — all implemented in optimizer.py and verifier/analyzer modules. There are no unrelated requirements (no cloud creds, no system-wide changes).
SKILL.md instructs running CLI commands (analyze, optimize, verify, health, setup-heartbeat, rollback). The runtime instructions and code only read/write files under ~/.openclaw (and check workspace files in cwd/home), and perform HTTP reachability checks for heartbeat providers. Dry-run is default and a diff preview is shown — this limits accidental changes. The analyzer/verify code scans workspace files for sizes and reads openclaw.json when present; this is within scope of 'optimizing OpenClaw'.
There is no install spec that downloads arbitrary code or archives. The package is Python code included in the skill bundle (cli.py and src/). No external installers or URL downloads are used; urllib.request is used only for reachability checks. This is low-risk compared to remote downloads or extract/install steps.
The skill declares no required environment variables or credentials. It checks for a local 'ollama' CLI with shutil.which and probes local/known endpoints (http://localhost:11434, http://localhost:1234, https://api.groq.com) for reachability. That network access is proportional to the advertised heartbeat-provider feature and does not require secrets.
The skill writes and backs up configuration under the user's home (~/.openclaw) and may create template and stats files there. always:false (not force-included). This is expected for a config-management tool, but note it will persist files in your home directory and create token-optimizer-stats.json/backups when applied. Dry-run previews help mitigate accidental writes.
Guidance
This package appears to do exactly what it says: preview changes by default and only write to ~/.openclaw when you pass --apply. Before applying: 1) Run the CLI in dry-run (python cli.py optimize) to review the diff. 2) Inspect the generated config and the templates in the repo if you want to confirm changes to prompts/SOUL.md/USER.md. 3) Backups are created under ~/.openclaw/backups — verify they exist after an apply. 4) The tool checks local services (e.g., looks for an 'ollama' CLI and probes localhost endpoints) and can contact known public endpoints for provider reachability; if you want zero network activity, avoid using heartbeat providers that require external endpoints. 5) Because source authorship is an external GitHub account and this skill will persist files in your home directory, only apply changes if you trust the author or have reviewed the code/templates yourself. If you want extra safety, run it in a sandboxed environment or inspect the code files before running with --apply.
Latest Release
v1.0.18
Remove slack target, default all CLI commands to dry-run, add file modification docs
Popular Skills
Published by @smartpeopleconnected on ClawHub
