TrustLog Guard

Financial governance for OpenClaw agents. Tracks API spend, enforces budget limits, detects runaway loops, delivers cost briefings. Reads session .jsonl logs...

This skill appears to do what it claims (read session logs, report spend, write a budget file), but the package metadata did not declare the local files it reads/writes. Before installing, consider: 1) Inspect a sample of your ~/.openclaw/agents/*/sessions/*.jsonl files to confirm they don't contain secrets you don't want scanned or stored. 2) Ask the publisher for the skill source or a detailed manifest showing which exact paths it will read/write and an explicit privacy guarantee — the SKILL.md's '100% private' claim is not verifiable as-is. 3) If you proceed, run it in a restricted environment or backup your data; verify the budgets file location (~/.openclaw/workspace/trustlog-guard/budgets.json) and ensure you’re comfortable with the agent creating/writing that file. 4) Prefer skills that declare required config paths and provide source code or provenance. If you need lower risk, request the same functionality implemented as a small local utility you can inspect and run separately rather than an autonomously-invokable skill.

Type: OpenClaw Skill Name: trustlog-guard Version: 1.1.0 The skill bundle is classified as benign. Its stated purpose is financial governance, tracking API spend, and enforcing budgets, which aligns with its instructions. The `SKILL.md` explicitly states "100% local," "No external servers," and "No data transmission," and the instructions for the AI agent consistently adhere to this, focusing solely on reading local OpenClaw session logs (`.jsonl`) and its own budget configuration (`budgets.json`). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent for harmful purposes.