Openclaw Context Optimizer

Intelligently compresses and optimizes context to reduce token usage by 40-60%, using deduplication, pruning, summarization, and adaptive learning.

What to consider before installing: - Mismatch & file presence: Although registry metadata suggests 'instruction-only' and 'no config paths', this package contains a Node project that writes a SQLite DB and config under ~/.openclaw/openclaw-context-optimizer/. Expect on-disk storage and an HTTP dashboard on localhost (9092). - Autonomous payments: The skill enables agents to subscribe to a Pro tier (0.5 USDT/month) via a local x402 API. AGENT-PAYMENTS.md warns the MVP trusts reported tx hashes (no on-chain verification). If you give an agent wallet access, it could authorize payments or potentially claim payments without on-chain proof. Do not grant real wallet keys or signing capability to untrusted agents. - Least privilege: If you still want to use it, run it in an isolated environment (sandbox or container), and do not expose a funded wallet to autonomous agents. Prefer manual payment workflows or require explicit human confirmation for upgrades. - Audit & test: Review the included source (especially src/x402.js, src/index.js, and dashboard code) before running. Confirm whether verifyPayment does any on-chain RPCs, and if not, require that in production. Search for any network calls to remote hosts beyond localhost; monitor network activity during initial runs. - Backup & privacy: The optimizer stores compressed and original contexts locally. If your contexts contain sensitive data, treat the DB and config directory as sensitive and back them up/secure them accordingly. - If uncertain: mark this skill as suspicious and prefer a vetted alternative or request the maintainer to implement proper on-chain verification, explicit install instructions, and clearer metadata (declaring config paths and required permissions).

Type: OpenClaw Skill Name: openclaw-context-optimizer Version: 1.0.0 The OpenClaw Context Optimizer skill is designed for a benign purpose: reducing token usage through intelligent context compression. However, it contains a critical vulnerability in its x402 payment verification logic. The `verifyTransactionOnChain` method in `src/x402.js` is explicitly marked as an MVP placeholder that 'trusts reported transaction hashes' and currently accepts any transaction hash longer than 32 characters as valid. This allows any agent to bypass payment verification and gain unauthorized access to the 'Pro tier' (unlimited compressions) without actually paying. This vulnerability is also openly documented in `AGENT-PAYMENTS.md`.