openclaw-tally

Tokens tell you how much you paid. Tasks tell you what you got. Tally tracks every OpenClaw task from start to finish — cost, complexity, and efficiency score.

This skill appears coherent and local-only: it needs node/npm and will run npm install (including a native build for better-sqlite3) and write a SQLite DB at ~/.openclaw/tally/tally.db. Before installing: 1) be prepared to run native builds (Node >=18) or install prebuilt binaries for better-sqlite3 on your platform; 2) if you require absolute assurance that no message content is stored, audit any code paths that might populate intent_summary/outcome_summary (currently detector returns empty summaries); 3) consider running it in a test user account or VM to verify behavior and DB location; and 4) review the GitHub repo (package.json points to https://github.com/JonathanJing/openclaw-tally) if you want source provenance. Minor notes: src/index.js exports VERSION '0.1.0' while package/skill metadata are 0.3.1 (version mismatch only).

Type: OpenClaw Skill Name: openclaw-tally Version: 0.3.1 The OpenClaw Tally skill is classified as benign. The code and documentation consistently declare and enforce strict security boundaries, including no network access, no arbitrary `exec` permissions, and sandboxed filesystem writes limited to `~/.openclaw/tally/`. All database interactions in `src/ledger.js` use prepared statements, effectively preventing SQL injection. Path validation in `src/ledger.js` explicitly restricts database file creation to allowed directories, mitigating arbitrary file write vulnerabilities. The `SKILL.md` and `README.md` are straightforward documentation without any prompt injection attempts against the agent. While `better-sqlite3` is a native dependency, it is a legitimate and widely used library for SQLite in Node.js, and its use does not indicate malicious intent within this skill.