Butler - AI Agent Treasury & Orchestration Skill
Butler automates token management and agent orchestration for AI tasks, optimizing resource allocation and enhancing operational efficiency.
Install this skill
Security score
The Butler - AI Agent Treasury & Orchestration Skill skill was audited on Feb 9, 2026 and we found 16 security issues across 2 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 89 | // Simple spawn (auto-decompose) |
Template literal with variable interpolation in command context
| 34 | console.log(`✅ Allocated ${allocation.allocated} tokens on ${allocation.provider}`); |
Template literal with variable interpolation in command context
| 115 | console.log(`Sub-task ${result.subTaskId}:`); |
Template literal with variable interpolation in command context
| 116 | console.log(` Status: ${result.status}`); |
Template literal with variable interpolation in command context
| 117 | console.log(` Tokens: ${result.tokensUsed}`); |
Template literal with variable interpolation in command context
| 118 | if (result.error) console.log(` Error: ${result.error}`); |
Template literal with variable interpolation in command context
| 245 | console.log(` |
Template literal with variable interpolation in command context
| 280 | console.log(` |
Template literal with variable interpolation in command context
| 319 | console.log(`⚠️ ${aggregated.failed} sub-tasks failed:`); |
Template literal with variable interpolation in command context
| 323 | console.log(` - ${d.id}: ${d.error}`); |
Template literal with variable interpolation in command context
| 350 | console.log(` |
Template literal with variable interpolation in command context
| 361 | console.log(` |
Template literal with variable interpolation in command context
| 372 | console.log(`\nAvailable keys: ${available.length}`); |
Template literal with variable interpolation in command context
| 374 | console.log(` - ${key.id} (${key.provider}): ${key.limits.tokens_per_day.toLocaleString()} tokens/day`); |
Access to hidden dotfiles in home directory
| 477 | # Optional - defaults to ~/.openclaw/workspace/api-keys.json |
Access to hidden dotfiles in home directory
| 480 | # Optional - defaults to ~/.openclaw/workspace/token-manager-state.json |