StartClaw-Optimizer

Master optimization system - APPLIES TO EVERY RESPONSE. Before responding, classify task complexity (simple question vs analysis vs coding). Use Haiku for simple/navigation/extraction/status. Use Sonnet ONLY for writing/analysis/planning/debugging. Monitor context size - if >50k tokens, recommend /compact. For automations, use scheduler wrapper. Never load full conversation history for simple tasks. Heartbeats always Haiku, single-line only. Never use Opus. This skill MUST run before every response to prevent 100k+ token bloat.

This package looks like a legitimate optimizer library, but several inconsistencies and sloppy packaging elements mean you should be cautious: 1) The description insists it must run before every response, but the registry flags do not enforce that — decide deliberately whether you want it auto-invoked. 2) The code references model names (Haiku/Sonnet/Opus) but requests no API keys; verify how your agent would supply model credentials before trusting automatic routing. 3) package.json omits dependencies (the code requires 'tiktoken'); prefer installing from a vetted source or run the bundled code in a sandbox to inspect runtime behavior. 4) The dashboard reads ~/.clawdbot/optimizer/config.json and compaction logs sessionKey and token counts — check that file for sensitive info and consider logging redaction. 5) Because the package owner and homepage are unknown, verify the npm package integrity (if you plan to npm install) and review the code locally. If you want to proceed, audit/modify the SKILL.md to remove the hard "MUST run before every response" instruction (or set always:true intentionally) and add explicit dependency and credential guidance. If you are not able to review or sandbox it, do not install it into production or grant it autonomous execution.

Type: OpenClaw Skill Name: startclaw-optimizer Version: 1.0.2 The skill bundle provides components for optimizing AI agent workflows, including task routing, scheduling, browser management, and context compaction. The `scripts/dashboard.py` file reads a specific configuration file (`~/.clawdbot/optimizer/config.json`) which is a plausible action for a dashboard, and its network metric fetching is explicitly simulated. The `context-compaction.js` file contains a placeholder for a future API call but does not make any actual network requests in its current state. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.