Security audit
caveman-claw
Security checks for vulnerabilities and agentic risk
Overview
The plugin's code and runtime instructions match its claim to compress assistant history, inject short system instructions, and track token savings; nothing requested or installed is disproportionate to that purpose, though it does modify local files and auto-activate by default which you should be aware of.
This skill appears to do exactly what it says: compress assistant history, inject brief system instructions, and track savings. Before enabling it consider: (1) the default config turns 'caveman mode' on for every new session — set globalByDefault:false if you prefer opt-in; (2) the /cc compress command rewrites files in-place (it creates a '.original.md' backup, but test carefully on important docs); (3) the plugin writes savings and session state to its local data/ directory inside the plugin install path; (4) it reads your OpenClaw config (~/.openclaw/openclaw.json and models.json) only to estimate pricing. If you want extra caution, review the repository locally, run it in a test agent or disable globalByDefault before enabling, and back up any files you might compress.
Static analysis
No suspicious patterns detected.
