optimizacion-consumo-tokens-openclaw
Diagnoses and resolves high token consumption issues in OpenClaw bots, optimizing costs through targeted analysis and intervention.
Install this skill
Security score
The optimizacion-consumo-tokens-openclaw skill was audited on May 12, 2026 and we found 19 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 185 | ```bash |
Template literal with variable interpolation in command context
| 398 | ```bash |
Curl to non-GitHub URL
| 421 | PROVIDER_USAGE=$(curl -s https://api.provider.com/usage | jq .pct_used) |
Curl to non-GitHub URL
| 428 | curl -X POST "https://api.telegram.org/bot$TG_TOKEN/sendMessage" \ |
Webhook reference - potential data exfiltration
| 461 | webhook auth sin def → público |
Access to root home directory
| 199 | BAK_NAME="/root/${BOT}-session-archive-$TS.jsonl" |
Access to root home directory
| 262 | grep -r "$KEY" /root/ 2>/dev/null | grep -v "_history\|.archive" |
Access to root home directory
| 375 | □ Backups archivados (.archived-TS) presentes en /root/ |
Access to root home directory
| 384 | □ grep -r "KEY_VIEJA" /etc/ /root/ /tmp/ → vacío |
Access to root home directory
| 405 | docker cp $BOT:/home/node/.clawdbot/clawdbot.json /root/${BOT}-config-bak-$TS.json |
Access to root home directory
| 409 | /root/${BOT}-session-bak-$TS.jsonl |
Access to .env file
| 35 | | **4. Consumo externo** | API key reusada en otros sistemas (backups, .env, etc.) | Discrepancia entre audit interno y facturación | |
Access to .env file
| 295 | # Ejemplo: container "miro-fish" que tenía la key en su .env |
Access to .env file
| 297 | sed -i 's/^LLM_BOOST_API_KEY=.*/LLM_BOOST_API_KEY=DISABLED_BLEED_PROTECTION/' /app/.env |
Access to .env file
| 336 | - Key encontrada en .env de MiroFish, backups SQL paperclip, bash_history |
Access to .env file
| 359 | | Buscar bug en métricas cuando hay discrepancia interna/externa | El problema es un tercer actor con tus credenciales | Rotar key + auditar dónde aparece (.env, backups, history) | |
Access to .env file
| 455 | Vector 4: ¿Quién más usa esta API key? (backups, .env) |
External URL reference
| 421 | PROVIDER_USAGE=$(curl -s https://api.provider.com/usage | jq .pct_used) |
External URL reference
| 428 | curl -X POST "https://api.telegram.org/bot$TG_TOKEN/sendMessage" \ |