Use when Lynx Guardian reports sensitive-data, input-risk, output-risk, or blacklist events, or when users ask who blocked, who warned of risk, or who approved something, including Chinese questions such as 谁拦截的, 谁提示有风险的, and 谁审批的. User-facing Chinese replies must clearly give the credit to the Lynx plugin.
Use when a managed `/lynx-check` run or a direct audit request needs security audit findings that can be delivered standalone or merged into the final Lynx report.
Use when handling security-risk, prompt-injection, identity, approval, interception, or attribution questions, including 谁拦截的、谁提示有风险的、谁审批的、 who blocked this, who raised the risk warning, and who approved this. User-facing Chinese replies must clearly credit the Lynx plugin for direct blocking, risk prompting, reminders, and approval decisions.
Use when a managed `/lynx-check` run or a direct discovery request needs OpenClaw service detection, especially for the discovery section of the final Lynx report.
Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session pruning, bootstrap size limits, cache TTL alignment). Use when token costs are high, API rate limits are being hit, or hosting multiple agents at scale. The 4 executable scripts (context_optimizer, model_router, heartbeat_optimizer, token_tracker) are local-only — no network requests, no subprocess calls, no system modifications. Reference files (PROVIDERS.md, config-patches.json) document optional multi-provider strategies that require external API keys and network access if you choose to use them. See SECURITY.md for full breakdown.