Is jzOcb/token-guard safe?
Yes. jzOcb/token-guard is safe to install. Oathe's behavioral security audit gave the token-guard skill by jzOcb a trust score of 84/100 with 3 findings, none critical or high.
https://github.com/jzOcb/token-guard
Is jzOcb/token-guard safe to install?
Token Guard is a legitimate budget monitoring tool that tracks AI token usage and costs. While it accesses user configuration files and can modify system settings, these capabilities align with its stated purpose of preventing excessive spending through budget monitoring and automatic model downgrading.
What security issues were found in jzOcb/token-guard?
Category Scores
Findings (3)
MEDIUM Accesses User Configuration Files -20 ▶
The skill accesses user configuration files ($HOME/.clawdbot/clawdbot.json, $HOME/.openclaw/openclaw.json) that may contain API keys or other sensitive configuration data. While this appears necessary for its stated functionality, it represents potential access to sensitive information.
LOW Contains Executable Shell Script -15 ▶
The skill includes an executable bash script (token-guard.sh) that performs token monitoring and cost management operations. The script appears legitimate and matches the stated purpose of budget monitoring.
LOW System Configuration Modification Capability -25 ▶
The skill can modify system configuration by making API calls to the local gateway to change model settings when budget limits are exceeded. While this matches the stated auto-downgrade functionality, it represents the ability to alter system behavior.
Should I install jzOcb/token-guard?
Oathe's verdict for jzOcb/token-guard is SAFE with a trust score of 84/100. Recommendation: Install.