by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it claims: it reads local conversation logs to compute token and cost stats and writes local state files. Before installing, verify (1) you are comfortable that the script will read your ~/.openclaw/agents/main/sessions logs (these contain user/assistant messages), (2) the hardcoded run path in SKILL.md matches your install location or update the invocation to the actual script path, (3) you are okay with the skill's fail-closed behavior (it can block sending messag...详细分析 ▾
ℹ 用途与能力
The skill's description (generate token/cost stats) matches its actions: it reads local session jsonl files and aggregates usage, and writes local state/counter files. Minor mismatch: SKILL.md tells the agent to run a hardcoded path (/home/admin/.openclaw/...), while the bundled script contains portable path-detection logic; this could cause the documented invocation to fail on systems where that exact path doesn't exist.
ℹ 指令范围
Instructions are narrow and specific: run the bundled Python script immediately before sending replies, append one exact token line, and fail-closed if the script fails. The script only reads local session logs (~/.openclaw/agents/main/sessions) and updates workspace/memory state. This is within scope for token reporting, but noteworthy because the skill will block sending messages if the script fails (operational impact) and it reads full conversation logs (sensitive data) — however it does not network-out or request extra credentials.
✓ 安装机制
No install spec; skill is instruction-only with a bundled Python script. There are no network downloads or external package installs, and the script is present in the skill bundle. Low install risk.
ℹ 凭证需求
The skill requests no environment variables or credentials, which is appropriate. It does require read access to session log files (conversation transcripts) and write access to its own workspace/memory files — this access is necessary for its purpose but involves exposure of conversation contents, so consider privacy implications.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills. It writes state and counter files under its own workspace/memory directory (token-agg-state.json, token-counter.json), which is expected for aggregation state.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.02026/4/1
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install token-stats-reporter
镜像加速npx clawhub@latest install token-stats-reporter --registry https://cn.longxiaskill.com镜像同步中