Cost Optimizer

Smart cost optimization skill for OpenClaw. Reduces API costs by 70-97% through intelligent model routing, session management, output efficiency, and free mo...

This package appears to do what it says: it reads your OpenClaw config, workspace files, and logs to estimate costs and can produce config patches (after auto-backup) to apply presets. Before installing, review these points: 1) Inspect parse-config.js and scripts that use new Function()/eval-like parsing — they execute local config text as JS to support JSON5/JS-style configs; only install if you trust the config files on the host. 2) The tools will read logs (/var/log/..., ~/.openclaw/...) and may make real provider API calls using whatever provider credentials are already configured — provide OpenRouter/API keys only if you want free-model usage enabled. 3) apply-preset.sh auto-creates patches and runs backup-config.sh (it does not forcibly overwrite your config without a follow-up apply step, but double-check generated patch files in /tmp before applying). 4) If you will expose a webhook URL for reports, review webhook-report.sh to ensure it only posts intended data. Recommendation: run scripts in dry-run modes first (apply-preset.sh --dry-run, or run cost-audit.sh) and review /tmp patch contents and backups before applying changes; consider testing in a non-production or sandboxed OpenClaw instance if available.

Type: OpenClaw Skill Name: open-optimise Version: 0.1.0 The skill is a highly complex utility for API cost optimization that requires extensive system-level access, including the ability to modify the core 'openclaw.json' configuration, read system logs, and restart the gateway service. While its features are aligned with its stated purpose, it contains several security vulnerabilities: the use of 'new Function()' in 'parse-config.js' and 'cost-dashboard.js' to parse configuration files creates a risk of code execution if the config is compromised, and 'setup-openrouter.sh' accepts sensitive API keys as command-line arguments, potentially exposing them in process listings. The combination of high-privilege operations and unsafe coding patterns warrants a suspicious classification.