Prompt Token Counter

Count tokens and estimate costs for 300+ LLM models. Primary use: audit OpenClaw workspace token consumption (memory, persona, skills).

This skill appears internally consistent with its purpose, but it legitimately reads sensitive OpenClaw workspace files (AGENTS.md, SOUL.md, MEMORY.md, SKILL.md, etc.). Before installing: (1) review scripts/cli.py and scripts/core.py if you are concerned about data flow; (2) run the CLI locally in an isolated environment against test files to confirm behavior; (3) do not allow URL fetches unless you explicitly confirm each URL (the SKILL.md requires confirmation — ensure the agent follows that); (4) you only need to provide API keys if you intentionally run the example 'API mode' benchmark (otherwise no credentials are required); (5) if your workspace contains secrets, avoid installing or run the tool on a copy of the workspace. If you want stronger assurance, ask the maintainer for a signed release or audit the code paths that read ~/.openclaw/openclaw.json and the workspace to confirm there is no unexpected network exfiltration.

Type: OpenClaw Skill Name: prompt-token-counter Version: 1.0.11 The prompt-token-counter bundle is a legitimate utility designed to estimate LLM token usage and API costs. It includes a Python-based CLI (scripts/cli.py) and core logic (scripts/core.py) that support over 300 models. While the skill is designed to read sensitive OpenClaw configuration files (e.g., AGENTS.md, SOUL.md) and fetch content from URLs, these actions are aligned with its stated purpose of auditing workspace token consumption. Crucially, the SKILL.md file includes defensive instructions requiring the AI agent to warn users about SSRF risks and obtain explicit confirmation before making outbound network requests. No evidence of data exfiltration, malicious execution, or obfuscation was found.