OpenClaw Cost Auditor

Track and report OpenClaw API usage, model costs, token consumption, and forecast spending with optimization recommendations.

This skill appears to be a simple log parser that sums 'tokens: N' entries and estimates cost. Before installing: 1) Confirm whether the author intends the advertised API integrations and, if so, require explicit API credentials and documented endpoints. 2) Be aware the script reads /var/log/openclaw by default — run it with an explicit, non-privileged path first and inspect logs for sensitive content. 3) Ask for the missing files the SKILL.md references (templates/report.md, CLI wrapper) or run the script manually in a sandbox to verify behavior. 4) If you plan to allow autonomous invocation, restrict the skill's file-read permissions and ensure it cannot access unrelated system logs or secrets. 5) If you need networked metric aggregation, prefer an implementation that clearly requests and documents required credentials and safe transmission endpoints.

Type: OpenClaw Skill Name: openclaw-cost-auditor Version: 1.0.0 The `scripts/audit.py` file is vulnerable to arbitrary file reading due to its direct use of `sys.argv[1]` for the `log_dir` without any input validation or sanitization. An attacker could potentially exploit this by providing a path to sensitive directories (e.g., `/etc`, `~/.ssh`) via prompt injection to the OpenClaw agent, leading to information disclosure. While the script itself does not exfiltrate data or exhibit other malicious behaviors, this vulnerability represents a significant security risk.