Openclaw Iterm2 Statusbar

Install the OpenClaw iTerm2 status bar that shows session cost and context usage in real time.

What to consider before installing: - The code appears to do what it claims: poll a local OpenClaw Gateway and display cost/context in iTerm2. However the package metadata omitted that it needs an OPENCLAW_GATEWAY_TOKEN and reads ~/.openclaw/openclaw.json and ~/Library/LaunchAgents/ai.openclaw.gateway.plist. Treat that omission as a red flag: verify and understand where your token is stored before installing. - Avoid running the curl | bash one-liner without inspection. Instead download the repo or openclaw_status.py and inspect it locally before copying it into ~/Library/Application Support/iTerm2/Scripts/AutoLaunch. - Inspect ~/Library/LaunchAgents/ai.openclaw.gateway.plist (if present) to confirm it does not contain unrelated secrets you don't want scripts to read. Consider setting OPENCLAW_GATEWAY_TOKEN in your shell profile if you prefer explicitness. - Review ~/.openclaw/openclaw.json contents to ensure you are comfortable with the script reading it (it only reads compaction.reserveTokensFloor but user files can contain other data). - Confirm the OpenClaw Gateway is actually running on localhost:18789 and you trust its origin; the script only talks to that local endpoint (no external exfiltration observed), but a compromised local gateway could leak data. - If you decide to proceed, prefer manual installation (download, inspect, then copy) and keep backups of any tokens; if unsure, do not run the remote installer. If you discover unexpected behavior, remove the script from the AutoLaunch folder and revoke or rotate the gateway token.

Type: OpenClaw Skill Name: openclaw-iterm2-statusbar Version: 0.1.1 The skill bundle utilizes a high-risk installation pattern in SKILL.md and install.sh, instructing the AI agent to execute a 'curl | bash' command that downloads and runs remote code. The installer establishes persistence by placing a script in the iTerm2 AutoLaunch directory, and the resulting openclaw_status.py script accesses sensitive local files (~/Library/LaunchAgents/ai.openclaw.gateway.plist and ~/.openclaw/openclaw.json) to retrieve authentication tokens. While these actions appear necessary for the stated purpose of monitoring a local OpenClaw gateway, the combination of remote execution, persistence, and credential access is highly risky for an automated agent.