360 Secure SkillHub
360 安全技能中心

OpenClaw Cost Guard

对 OpenClaw 智能体配置做轻量静态成本审计:运行内置 Node 脚本检查是否存在显式预算信号、默认模型是否对常开使用过贵、浏览器/交互工具是否在缺乏成本约束下启用、token 上限是否过大以及是否叠加多种高成本模式,输出 score、verdict、findings、recommendations 等 JSON 结果并给出收紧护栏的建议。

x-rayluan
x-rayluan
热度 81.54
最近更新 2026-05-11 17:31:57
分类:安全依赖:代码执行 / 读写文件应用场景:自动化脚本 / 工作流 / DevOps / 报告撰写

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add openclaw-agent-cost-guard
Metadata
name
openclaw-cost-guard
description
This skill should be used when the user asks to reduce OpenClaw token spend, audit model and cron cost risk, prevent denial-of-wallet incidents, add budget guardrails, review expensive agent defaults, or tighten AI-agent cost governance before wider rollout.

OpenClaw Cost Guard

Use this skill to identify obvious cost leaks before they turn into a denial-of-wallet problem.

Goal

Move from “the agents work” to “the agents work within an intentional budget.”

Workflow

  1. Identify the target OpenClaw config or workspace.
  2. Run the bundled cost-guard script.
  3. Review expensive defaults, missing budgets, and high-risk patterns.
  4. If the result is FAIL, stop scaling usage until cost controls are tightened.
  5. Apply the narrowest guardrails that reduce spend without breaking the workflow.

Command

node {baseDir}/scripts/cost-guard.mjs --config ~/.openclaw/openclaw.json

The --config flag is optional. If omitted, the script checks the default OpenClaw config path.

What the script checks

  • whether explicit budget signals exist
  • whether default models look expensive for always-on usage
  • whether browser/interactive tooling appears enabled without cost discipline
  • whether token limits appear excessively large
  • whether the config contains multiple high-cost patterns at once
  • whether the setup needs a governance recommendation before scaling

Output format

The script returns JSON with:

  • score
  • verdict
  • summary
  • findings
  • recommendations
  • guardrails
  • evidence

Verdicts

  • PASS — no major lightweight cost-governance gap found
  • WARN — spend risk exists and should be reviewed
  • FAIL — denial-of-wallet risk is materially elevated

Important limits

  • This is a lightweight static review, not a bill-reconciliation system.
  • A low-risk config can still become expensive through user behavior or external automations.
  • Always verify against real provider invoices and usage telemetry.

References

  • {baseDir}/references/cost-playbook.md