Skill Perf

测量 OpenClaw 环境中 Skill 的 token 消耗和性能开销（仅适用于 OpenClaw Agent 环境）。当用户提到「测量」「测试」「性能」「token 消耗」「多少 token」「开销」「成本」「效率」或想要评估、对比、优化某个 skill 的资源使用时，立即使用此 skill。也适用于 sk...

This skill appears to do what it says: spawn subagents, read OpenClaw session files, and produce token/HTML reports. Before installing or running it, consider the following: - Audit the scripts (already included) to confirm you are comfortable with their filesystem reads (they access ~/.openclaw/agents/*/sessions.json and .jsonl files) and local API calls (http://localhost:3459). Those reads are needed to compute token usage but can surface user messages or other session content. - Run benchmarks in a controlled/test environment, not against production systems or skills that perform destructive/external actions (device control, API calls, financial ops), because benchmarking will execute the measured skill once per run. - The tool will start a local HTTP service to serve reports; ensure you are comfortable with a local port being opened and with placing reports under ~/.openclaw/skills/skill-perf/reports/. Review wait_and_report.sh / snapshot.py to confirm behavior. - Because there is no remote download step, installing requires cloning the repo into ~/.openclaw/skills/skill-perf as documented; ensure you trust the source before cloning. If you need stronger guarantees, run the scripts in an isolated environment or inspect/execute them line-by-line. If you want me to, I can: (a) list exact files and code paths that read session content, (b) highlight lines that spawn sessions or call local APIs, or (c) produce a short checklist for safely benchmarking a particular skill.

Type: OpenClaw Skill Name: skill-perf Version: 1.0.2 The skill bundle performs performance monitoring by accessing sensitive OpenClaw session logs (.jsonl) and workspace configuration files (e.g., AGENTS.md, SOUL.md) across multiple agent directories (main, xuexiguaishou, codeflicker) in scripts/snapshot.py. It also interacts with the local OpenClaw API (http://localhost:3459) to manage sessions in scripts/bench.py and spawns a local HTTP server to serve HTML reports. While these high-risk capabilities are aligned with the stated purpose of benchmarking token usage, the broad access to private conversation histories and the execution of a network service warrant a suspicious classification.