Token Usage Optimizer

Maximize your Claude Code subscription value with smart usage monitoring and burn rate optimization. Track 5-hour session and 7-day weekly quotas, get one-ti...

This skill appears to implement the advertised usage-monitoring functionality, but it asks you to provide your Claude access/refresh tokens and its scripts will read local credential files and may update your ~/.claude/.credentials.json automatically. Before installing or running it: - Only install from a source you trust (the registry shows unknown/unnamed origin here). Verify the repository and author. - Inspect the included scripts yourself (they're all present) and confirm you are comfortable with them reading/writing ~/.claude/.credentials.json and creating a local .tokens file. The scripts set .tokens permissions to 600, which is good, but ensure the file is stored in a safe location. - Consider running the tool in an isolated environment (container or dedicated user account) if you do not want it touching your main ~/.claude credentials. - If you proceed, keep tokens short-lived and rotate them after testing; avoid pasting long-lived credentials unless necessary. - If you want lower privilege: modify the scripts to disable the code that writes to ~/.claude/.credentials.json and require explicit user action to sync tokens. I rated this as suspicious (not malicious) because the behavior can be explained by legitimate integration needs, but the automatic modification of another app's credential file and the token-extraction guidance materially increase risk and deserve explicit user consent and review.

Type: OpenClaw Skill Name: token-usage-optimizer Version: 1.0.5 The skill bundle contains a critical shell injection vulnerability. The `scripts/setup.sh` script takes user input for `ACCESS_TOKEN` and `REFRESH_TOKEN` and writes it directly into the `.tokens` file. Other scripts (`scripts/check-usage.sh`, `scripts/auto-refresh-cron.sh`, `scripts/refresh-token.sh`) then use `source "$TOKEN_FILE"` to load these variables. An attacker could provide a crafted token (e.g., `"; evil_command #"`) during setup, leading to arbitrary code execution (RCE) when any of the sourcing scripts are run. Additionally, `scripts/check-usage.sh` uses `sed` to update the token file, which could also be vulnerable to injection if the token value is maliciously crafted. While the stated purpose is benign, these vulnerabilities allow for malicious exploitation.